Skip to content

[FedCM] Specify third party iframe display support #774

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
npm1 merged 6 commits into from
Oct 8, 2025
Merged

[FedCM] Specify third party iframe display support #774

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
edeb5a8
[FedCM] Specify third party iframe display support
cbiesinger Aug 26, 2025
64380a7
Address Ted's comment
cbiesinger Sep 5, 2025
5e26a9a
rename
cbiesinger Sep 10, 2025
5c6ccbe
same site
cbiesinger Oct 1, 2025
2bf47d0
Address comments
cbiesinger Oct 6, 2025
b48e5ba
comments
cbiesinger Oct 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 45 additions & 14 deletions spec/index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ spec:webdriver2; type:dfn; text:remote end steps
spec:fetch; type:dfn; for:/; text:response
spec:css-color-5; type:type; text:<color>
spec:html; type:dfn; text:allowed to use
spec:html; type:dfn; for:/; text:same site
</pre>

<style>
Expand Down Expand Up @@ -1078,8 +1079,23 @@ When asked to <dfn for="create identity credential">fetch accounts</dfn> given a
</div>

<div class="issue" heading="extension">
<div algorithm="show accounts extension">
An extension may use the following instead of the [=create identity credential/show accounts=] step, where

@npm1 npm1 Oct 7, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe wrap these in div algorithm to get things like variable highlighting?

@cbiesinger cbiesinger Oct 7, 2025

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done although that wasn't new. Fixed some bikeshed warnings that were triggered by this.

|permissionRequested| is sometimes set:
1. Let |embedderOrigin| be the |globalObject|'s [=Window/navigable=]'s
[=navigable/top-level traversable=]'s [=navigable/active document=]'s [=Document/origin=].
1. Let |rpOrigin| be |globalObject|'s [=associated Document=]'s [=Document/origin=].
1. Let |clientMetadataMap| be a new [=map=].
1. For each |provider| in <var ignore="">providerList</var>:
1. Let |configURL| be the |provider|'s {{IdentityProviderConfig/configURL}}.
1. If |provider|.{{IdentityProviderRequestOptions/fields}} is not [=list/empty=], or if
|embedderOrigin| is not [=same site=] with |rpOrigin|, set |clientMetadataMap|[|configURL|]
to the result of running [=fetch the client metadata=] with |config|, |provider|, and
|globalObject|.
1. If any entry in |clientMetadataMap| has
{{IdentityProviderClientMetadata/client_is_third_party_to_top_frame_origin}} set to true,
the dialog MUST show the [=host/registrable domain=] of |globalObject|'s [=associated
Document=]'s [=Document/origin=] to the user.
1. If |allAccounts| is not [=list/empty=], also add UI to present the account options to the user as follows:
1. Let |supportsUseOtherAccount| be `false`.
1. If |options|.{{IdentityCredentialRequestOptions/mode}} is `"active"`:
Expand Down Expand Up @@ -1117,16 +1133,19 @@ An extension may use the following instead of the [=create identity credential/s
and |globalObject| is [=compute the connection status/connected=], set |permission|
to true.
1. Otherwise, if |provider|.{{IdentityProviderRequestOptions/fields}} is [=list/empty=],
[=create a connection between the RP and the IdP account=] with |provider|, |account|,
and |globalObject|, and set |permission| to true.
[=create a connection between the RP and the IdP account=] with |provider|,
|selectedAccount|, and |globalObject|, and set |permission| to true.
Note: The connection would normally be created in the [=request permission to sign-up=]
algorithm, but we do not want to show an extra dialog in this case.
1. Otherwise:
1. Set |permission| to the result of running the [=request permission to sign-up=]
algorithm with |selectedAccount|, the relevant |config|, the relevant |provider|,
and |globalObject|.
1. Let |configURL| be the the relevant |provider|'s
{{IdentityProviderConfig/configURL}}.
1. Set |permission| to the result of running the [=request permission to
sign-up=] algorithm with |selectedAccount|, the relevant |provider|,
|clientMetadataMap|[|configURL|], and |globalObject|.
1. Set |permissionRequested| to true.
</div>
</div>


<!-- ============================================================ -->
Expand Down Expand Up @@ -1265,8 +1284,8 @@ or failure.
<div class="issue" heading="extension">
An extension which implements the client metadata endpoint must add the following step right before
the [=fetch the config file/check accounts and login url step=]:
1. If |config|.{{IdentityProviderAPIConfig/client_metadata_endpoint}} is set but either
|wellKnown|.{{IdentityProviderWellKnown/accounts_endpoint}} or
1. If <var ignore="">config</var>.{{IdentityProviderAPIConfig/client_metadata_endpoint}} is set
but either |wellKnown|.{{IdentityProviderWellKnown/accounts_endpoint}} or
|wellKnown|.{{IdentityProviderWellKnown/login_url}} is not set, return failure.
</div>

Expand Down Expand Up @@ -1567,8 +1586,8 @@ We may modify the spec to include {{IdentityProviderRequestOptions/fields}} in t
<div class="issue" heading="extension">
An extension may add the following steps after the [=fetch identity assertion/create a list=] step:
1. Let |disclosureShownFor| and |fields| be the empty list.
1. If |permissionRequested| is true:
1. Set |fields| to |provider|.{{IdentityProviderRequestOptions/fields}}.
1. If <var ignore="">permissionRequested</var> is true:
1. Set |fields| to <var ignore="">provider</var>.{{IdentityProviderRequestOptions/fields}}.
1. Set |disclosureShownFor| to the subset of strings in |fields| that are
in the [=list of recognized fields=].
1. If |fields| is not empty:
Expand Down Expand Up @@ -1609,16 +1628,13 @@ granted permission or not.

<div algorithm="request permission to sign-up">
To <dfn>request permission to sign-up</dfn> the user with a given an {{IdentityProviderAccount}} |account|,
an {{IdentityProviderAPIConfig}} |config|, an {{IdentityProviderRequestOptions}} |provider|, and a
|globalObject|, run the following steps. This returns a boolean.
an {{IdentityProviderRequestOptions}} |provider|, an {{IdentityProviderClientMetadata}} |metadata|,
and a |globalObject|, run the following steps. This returns a boolean.
1. Assert: These steps are running [=in parallel=].
1. Let |fields| be |provider|.{{IdentityProviderRequestOptions/fields}} or, if not present,
`["name", "email", "picture"]`.

Note: Omitted is different from an explicitly present empty list.
1. Let |metadata| be null.
1. If |fields| is not [=list/empty=], set |metadata| to the result of running [=fetch the client
metadata=] with |config|, |provider|, and |globalObject|.
1. Prompt the user to gather explicit intent to create an account. The user agent MAY use the
{{IdentityProviderBranding}} to inform the style choices of its UI. Additionally, if the user agent
<dfn>supports showing a permission prompt</dfn>:
Expand All @@ -1628,6 +1644,10 @@ an {{IdentityProviderAPIConfig}} |config|, an {{IdentityProviderRequestOptions}}
does not contain the fields required by the IDP. This is to enable user agents that
do not support showing a permission prompt.

1. If |metadata| is not null or failure, and
Comment thread
cbiesinger marked this conversation as resolved.
|metadata|.{{IdentityProviderClientMetadata/client_is_third_party_to_top_frame_origin}}
is `true`, this dialog MUST show the [=host/registrable domain=] of |globalObject|'s
[=associated Document=]'s [=Document/origin=] to the user.
1. If |fields| is not [=list/empty=]:
1. If |metadata| is not failure, |metadata|["{{IdentityProviderClientMetadata/privacy_policy_url}}"]
is defined, and the |provider|'s {{IdentityProviderConfig/clientId}} is not in the list of
Expand Down Expand Up @@ -1667,6 +1687,16 @@ an {{IdentityProviderRequestOptions}} |provider|, run the following steps. This
1. Let |clientMetadataUrl| be the result of [=computing the manifest URL=] given |provider|,
|config|["{{IdentityProviderAPIConfig/client_metadata_endpoint}}"], and |globalObject|.
1. If |clientMetadataUrl| is failure, return failure.
1. Let |embedderOrigin| be the |globalObject|'s [=Window/navigable=]'s
[=navigable/top-level traversable=]'s [=navigable/active document=]'s [=Document/origin=].
1. Let |rpOrigin| be |globalObject|'s [=associated Document=]'s [=Document/origin=].
1. Set the [=URL-query string=] of |clientMetadataUrl| to the [=string/concatenation=] of the
following strings:
1. `"client_id="`
Comment thread
cbiesinger marked this conversation as resolved.
1. |provider|.{{IdentityProviderConfig/clientId}}
1. If |rpOrigin| is not [=same site=] with |embedderOrigin|:
1. `"&top_level_origin="`
1. The [=serialization of an origin|serialization=] of |embedderOrigin|
1. Let |request| be a new <a spec=fetch for=/>request</a> as follows:

: [=request/url=]
Expand Down Expand Up @@ -1709,6 +1739,7 @@ an {{IdentityProviderRequestOptions}} |provider|, run the following steps. This
dictionary IdentityProviderClientMetadata {
USVString privacy_policy_url;
USVString terms_of_service_url;
boolean client_is_third_party_to_top_frame_origin = false;
};
</xmp>

Expand Down