Skip to content

Add third party cookie relaxations for FedCM - #523

Merged
npm1 merged 2 commits into
mainfrom
3pBehavior
Jul 16, 2026
Merged

Add third party cookie relaxations for FedCM#523
npm1 merged 2 commits into
mainfrom
3pBehavior

Conversation

@npm1

@npm1 npm1 commented Nov 29, 2023

Copy link
Copy Markdown
Collaborator

Fixes #517


Preview | Diff

@npm1
npm1 requested a review from yi-gu November 29, 2023 22:33
Comment thread spec/index.bs
Comment thread spec/index.bs Outdated
Comment thread spec/index.bs Outdated
Comment thread spec/index.bs Outdated
Comment thread spec/index.bs Outdated
@npm1

npm1 commented Dec 1, 2023

Copy link
Copy Markdown
Collaborator Author

Based on discussion, we will need #526 first before moving forward on this PR.

@npm1 npm1 added the agenda+ Regular CG meeting agenda items label Jul 25, 2024
@npm1 npm1 removed the agenda+ Regular CG meeting agenda items label Aug 2, 2024

@npm1 npm1 left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is ready for another review, ptal

Comment thread spec/index.bs Outdated
Comment thread spec/index.bs Outdated
@npm1

npm1 commented Jul 15, 2026

Copy link
Copy Markdown
Collaborator Author

ptal

Comment thread spec/index.bs
[=compute the connection status/connected=]. This check can be performed by iterating
over the [=connected accounts set=] or by keeping a separate data structure to make these
lookups faster.
* There is no third party cookie access for |configUrl|'s [=url/origin=] on |document|'s

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should swap this step with the configUrl parse check below, right?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes since this uses configUrl, done

Comment thread spec/index.bs
1. Let |idpOrigin| be the [=url/origin=] corresponding to |provider|'s
{{IdentityProviderConfig/configURL}}.
1. Let |rpOrigin| be |globalObject|'s [=associated Document=]'s [=Document/origin=].
1. If |account| [=map/contains=] {{IdentityProviderAccount/approved_clients}},

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In step 1 above we have checked that the client id is on the list so this may not be needed.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Step 1 checks whether the list exists and client_id is not present. So it is possible still for the list to not exist at this point.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right. Technically speaking we can omit the "approved_clients contains client_id" check here but maybe it's more readable this way? Up to you.

@npm1
npm1 merged commit 540070a into main Jul 16, 2026
1 check passed
@npm1
npm1 deleted the 3pBehavior branch July 16, 2026 19:09
github-actions Bot added a commit that referenced this pull request Jul 16, 2026
SHA: 540070a
Reason: push, by npm1

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
github-actions Bot added a commit to mattdanielbrown/WebID that referenced this pull request Jul 16, 2026
SHA: 540070a
Reason: push, by pull[bot]

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

Allow user agents to use "Connected Accounts Set" with flexibility

6 participants