Do not allow consider an account connected if IDP says so

fedidcg / FedCM

A privacy preserving identity exchange Web API

https://fedidcg.github.io/FedCM

Other

357 stars 66 forks source link

Do not allow consider an account connected if IDP says so #513

Closed npm1 closed 7 months ago

npm1 commented 7 months ago

In this PR, we fix the case where an account has been observed to be connected in the past by the user agent, but the IdP explicitly says that this account is not connected via approved_clients. This could happen if a user has revoked the federated account, and so the IdP information should be respected. In other words, if approved_clients is present and implies that the account is not connected, the user agent should consider it to be disconnected.

Preview | Diff

npm1 commented 7 months ago

@bvandersloot-mozilla FYI about this editorial but fairly trivial spec bug fix. I'll look to see if we need to add WPT coverage for this or if there is already.