Delegating Client Hints to Third-Party Frames

Client hints requested by a page do not automatically reach the other origins that page embeds. Delegation is explicit, and the reasoning behind that default is worth understanding.

Hints are scoped to the requesting origin

When a browser records a hint request, it records it against the origin that sent the response header. Requests to other origins are unaffected.

An embedded frame from a different origin is therefore in the same position as a first-time visitor. It receives the low-entropy set and nothing else.

The same applies to asset hosts, media servers and measurement endpoints on separate domains. Being loaded by a page that has hints does not confer them.

The default prevents silent propagation

Without scoping, any origin embedded anywhere would inherit whatever hints the embedding page had obtained. Detailed client information would spread by inclusion rather than by decision.

Scoping keeps the grant tied to the party that asked and was permitted. Extending it becomes an act the top-level page performs deliberately.

This mirrors how other capabilities are handled in modern browsers. Permission granted to a document does not automatically flow to documents it embeds.

Delegation happens through permissions policy

The top-level page declares which origins may receive which hints, using the same policy mechanism that governs other delegated capabilities.

The declaration is per hint and per origin. A page can share the platform version with a media host without sharing anything else, and without sharing it with anyone else.

Granularity matters because embedded parties differ. A video host with a genuine need for device information is not in the same position as a measurement script.

Missing hints look like a bug in the third party

Symptoms usually surface as an embedded service reporting unknown devices or serving a generic asset. The service appears broken while the cause sits in the embedding page.

Diagnosis is straightforward once the model is understood: inspect what the frame's requests actually carry rather than what the top-level requests carry.

The two are routinely different, and comparing them is the fastest way to confirm a delegation gap rather than a service fault.

Delegation as a deliberate decision

Because delegation is written into the page, it creates a record of which embedded parties receive detailed client information. That record is reviewable.

Teams that treat it as a checklist item tend to delegate broadly and stop thinking about it. Treating it as an inventory of who receives what is the more useful posture.

The mechanism was designed to make that inventory possible. Its value comes from being read occasionally, not from being configured once.