search

w3c-fedid / FedCM

A privacy preserving identity exchange Web API
https://w3c-fedid.github.io/FedCM/
Other
375 stars 72 forks source link

web-identity file HTTP response does not require an application/json Content-Type #409

Closed philsmart closed 1 year ago

philsmart commented 1 year ago

This a minor point, as I am sure the FedCM API is only expecting a JSON response, but the API does not seem to care if GETing the .well-known/web-identity file includes an application/json Content-Type response header. It works fine if there is no Content-Type header.

philsmart commented 1 year ago

It does not read any Content-Type. I sent text/xml for the json response and it worked. Like a say, probably a small thing.

npm1 commented 1 year ago

Are you asking about the Chrome implementation mismatching something in the spec? Just want to clarify what the issue is

philsmart commented 1 year ago

Ah, my fault. Yes, the API in Chrome Canary Version 111.0.5559.0 (Official Build) canary (arm64). My assumption would be, it would check the response is a JSON MIME Type. There are some references to this in the spec. but possibly for the assertions API only: https://fedidcg.github.io/FedCM/#browser-api-rp-sign-in

If mimeType is failure or is not a JSON MIME Type, throw a new "NetworkError" DOMException.