Skip to content

FedCM nonce Parameter Deprecation Specification - #762

Closed
pottis wants to merge 6 commits into
w3c-fedid:mainfrom
pottis:nonce_deprecate
Closed

FedCM nonce Parameter Deprecation Specification#762
pottis wants to merge 6 commits into
w3c-fedid:mainfrom
pottis:nonce_deprecate

Conversation

@pottis

@pottis pottis commented Jul 15, 2025

Copy link
Copy Markdown
Contributor

The Federated Credential Management (FedCM) API currently allows Identity Providers (IdPs) to specify a nonce parameter as a top-level field in the provider configuration object. This specification proposes deprecating this top-level parameter and moving it to the params object, which is the intended location for all IdP-specific parameters. This change will improve API consistency while maintaining backward compatibility during a transition period.

@pottis pottis changed the title FedCM Nonce Parameter Deprecation Specification FedCM nonce Parameter Deprecation Specification Jul 15, 2025

@TallTed TallTed left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Markup tweaks for clarity

Comment thread explorations/nonce_deprecate.md Outdated
Comment thread explorations/nonce_deprecate.md Outdated
Comment thread explorations/nonce_deprecate.md Outdated
Comment thread explorations/nonce_deprecate.md Outdated
Comment thread explorations/nonce_deprecate.md Outdated
Comment thread explorations/nonce_deprecate.md
Comment thread explorations/nonce_deprecate.md Outdated

@npm1 npm1 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the writeup! A lot of this seems written from the Chromium perspective, such as the plan to mitigate the backwards incompatible change (since only Chromium has shipped FedCM). I suppose it doesn't harm to document the plan, but this should probably be made more concise as the proposed spec change here is very simple. In fact, I would have probably directly sent a PR to modify the spec, which this PR is not doing.

Comment thread explorations/nonce_deprecate.md Outdated
Comment thread explorations/nonce_deprecate.md
Comment thread explorations/nonce_deprecate.md
Comment thread explorations/nonce_deprecate.md
- Show a deprecation warning in developer tools when the top-level parameter is used

2. After the transition period, the browser:
- MAY reject requests that use the top-level `nonce` parameter

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is what would happen. Parameters that are not members of the dict are just ignored.

- SHOULD continue to show deprecation warnings until the parameter is fully removed

3. When constructing token requests to the IdP:
- Use the `nonce` from `params` if available

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't make sense. Params is arbitrary, so you can always define nonce on it.

Comment thread explorations/nonce_deprecate.md Outdated

### 5.1. Browser Implementation

The browser should modify the token request generation code to extract the `nonce` from the `params` object when available:

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The browser should modify the token request generation code to extract the `nonce` from the `params` object when available:
The browser should modify the token request generation code to extract the `nonce` from the `params` object when available.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But actually I think this is just wrong, the browser would not need to modify anything since params is already sent to the IDP. The difficult part is removing support to send the nonce from outside of params.

Comment thread explorations/nonce_deprecate.md Outdated
Comment thread explorations/nonce_deprecate.md

The IdP implementation remains unchanged as the browser will continue to pass the nonce parameter to the token endpoint in the same format.

## 7. Migration Path

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems repetitive with a previous section.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although the content may appear repetitive, it is presented under distinct headers/sections. If you feel the repetition should be minimized, please let me know which section you'd prefer to remove.

@npm1 npm1 added the agenda+ Regular CG meeting agenda items label Jul 16, 2025
@togamid

togamid commented Jul 17, 2025

Copy link
Copy Markdown
Contributor

My understanding of the "params" property was that its content is deliberately arbitrary to allow protocols building on FedCM like FedCM for OAuth by aaronpk to define it. Moving the nonce parameter into "params" (or even parsing "params" in the browser implementation to extract the nonce) would change that.
In my opinion, the "nonce" option doesn't hurt that much as it is now. If it causes trouble, it might be better to just remove it entirely and specify that protocols that care about replay attacks need to define a nonce as part of the "params" option without actually defining how exactly they should do it.

@aaronpk

aaronpk commented Jul 17, 2025

Copy link
Copy Markdown

If i remember the discussions correctly, the intent was to deprecate the nonce parameter entirely, as not every protocol that leverages FedCM will use a parameter called nonce. If you are using a protocol that needs nonce, then you can put a nonce field in params.

#582 (comment)

w3c-fedid/custom-requests#3

### 4.1. Browser Behavior

1. During a transition period, the browser MUST:
- First, check for `nonce` in the `params` object

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should not be needed, right? params should be passed where nonce is passed. No need to 'check' for it

Comment thread explorations/nonce_deprecate.md Outdated
Comment thread explorations/nonce_deprecate.md Outdated
Comment thread explorations/nonce_deprecate.md Outdated

### Phase 2: Elevate Warning to Error

- Warning is upgraded to an error-level message

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally, having a non-existent type in a dict does not lead to an error, so should this actually be an error?

3. When constructing token requests to the IdP:
- Use the `nonce` from `params` if available
- Use the top-level `nonce` as fallback during transition
- Pass the `nonce` value to the assertion endpoint as before

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The purpose of the change is that the browser does not need to know about nonce at all. So, an RP would pass the nonce to the IDP using params, it would be sent like any other param, and the browser gets out of sending the toplevel nonce parameter that it does today.

@hlflanagan

Copy link
Copy Markdown
Contributor

Discussed on the July 29 call.

@hlflanagan hlflanagan removed the agenda+ Regular CG meeting agenda items label Jul 29, 2025
@npm1

npm1 commented Aug 1, 2025

Copy link
Copy Markdown
Collaborator

Closing this since the spec change is done.

@npm1 npm1 closed this Aug 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants