---
title: "Experimenting with the proposed Cross-Origin Storage API in Transformers.js"
description: "Transformers.js browser apps currently redownload and recache identical AI model and WebAssembly resources when they are requested from different origins. Chrome's cache uses a Network Isolation Key composed of the top-level site and current-frame site, so matching CDN URLs do not produce cache hits; the toy example incurs 177 MB of duplicate model storage, while a shared ONNX Runtime Wasm file is 4,733 kB. The proposed Cross-Origin Storage (COS) API addresses this by identifying large files with cryptographic hashes and sharing them across opted-in origins, with a polyfill extension enabling experimentation before native browser support. In the extended Transformers.js flow, a COS lookup can serve resources in milliseconds, while a miss downloads and stores them, and ModelRegistry.is_pipeline_cached() can help select among models already cached."
---

# Experimenting with the proposed Cross-Origin Storage API in Transformers.js

[Hugging Face](https://yomu.fyi/company/hugging-face) · Thomas Steiner · Jun 23, 2026

**Type:** Tutorial

## Summary

Transformers.js browser apps currently redownload and recache identical AI model and WebAssembly resources when they are requested from different origins. Chrome's cache uses a Network Isolation Key composed of the top-level site and current-frame site, so matching CDN URLs do not produce cache hits; the toy example incurs 177 MB of duplicate model storage, while a shared ONNX Runtime Wasm file is 4,733 kB. The proposed Cross-Origin Storage (COS) API addresses this by identifying large files with cryptographic hashes and sharing them across opted-in origins, with a polyfill extension enabling experimentation before native browser support. In the extended Transformers.js flow, a COS lookup can serve resources in milliseconds, while a miss downloads and stores them, and ModelRegistry.is\_pipeline\_cached() can help select among models already cached.

## Context

Different origins cannot reuse browser-cached AI model or WebAssembly resources even when their resource URLs are identical. Chrome's Network Isolation Key partitions those cache entries to mitigate timing-based security and privacy leaks, causing duplicate downloads and storage; the example reports 177 MB of duplicated resources.

## Approach / What changed

The proposed Cross-Origin Storage API exposes navigator.crossOriginStorage for large files identified by cryptographic hashes rather than URLs or origins. Transformers.js can opt in with env.experimental\_useCrossOriginStorage = true, look up resources in COS, download and store misses, and fall back to the Cache API when COS is unavailable. Its Model Registry can also check cached files across candidate models.

## Takeaways

- Chrome's Network Isolation Key combines the top-level site and current-frame site, so identical CDN URLs can still produce separate cache entries across origins.
- Cross-Origin Storage identifies resources by cryptographic hash, allowing the same model or Wasm file to be shared across opted-in origins regardless of where it was fetched.
- The COS API is not natively implemented in browsers; the Cross-Origin Storage extension provides a polyfill, and Transformers.js falls back to the Cache API when COS is unavailable.

**Tags:** [Caching](https://yomu.fyi/topic/caching), [Machine Learning](https://yomu.fyi/topic/machine-learning), [Performance](https://yomu.fyi/topic/performance), [Privacy](https://yomu.fyi/topic/privacy)

- Source: [Hugging Face](https://huggingface.co/blog/cross-origin-storage)
- Source URL: https://huggingface.co/blog/cross-origin-storage
- Ingested by Yomu: 2026-08-29T01:51:01.805Z

[Read original post](https://huggingface.co/blog/cross-origin-storage)