search

fedidcg / FedCM

A privacy preserving identity exchange Web API
https://fedidcg.github.io/FedCM
Other
357 stars 66 forks source link

The Registration API: Remove the user gesture requirement behind `IdentityProvider.register()` #593

Open samuelgoto opened 1 month ago

samuelgoto commented 1 month ago

Came up in the FedID CG call in a discussion @aaronpk.

@cbiesinger brought this up in the past, so FYI.

I don't think it is strictly necessary, as far as privacy and security is concerned, but it is also not clear to me how an IdP would provide a user experience without an explicit user action.

Anyway, seems like a valid feature request, so tracking it here.

samuelgoto commented 1 month ago

@npm1 says he is working on it! That was fast! :)

cbiesinger commented 1 month ago

FWIW, the reason I had previously brought it up was that I was thinking IdPs may want to register as soon as the user logs in successfully

aaronpk commented 1 month ago

I do think some/many IdPs would want to call register as soon as the user logs in, but I'm not actually sure that is the best idea. I can definitely see that getting abused by websites that aren't "actually" IdPs for example.

I don't think it's bad to require a user gesture first. Browser popups like the location and notification permission are already pretty noisy when you go to random websites, I'd hate to see this one get added to the noise too.

samuelgoto commented 1 month ago

Browser popups like the location and notification permission are already pretty noisy when you go to random websites, I'd hate to see this one get added to the noise too.

Yeah, that was my intention having it be behind a user gesture: abuse and permission blindness. Glad some of that matches your intuition too.

npm1 commented 1 month ago

@npm1 says he is working on it! That was fast! :)

For the record, I was not talking about this issue 😆

obfuscoder commented 1 month ago

Is this user interaction/gesture also required for registering an IdP via the response header? One scenario I can think of right away is that an IdP would like to silently register while performing a SSO via OpenIdConnect/OAuth redirect flow which does not need an interaction if there is already a signed-in state.

obfuscoder commented 1 month ago

Oh wait, there is no FedCM IdP registration via response header. I mixed that one up with login status.