search

w3c-fedid / FedCM

A privacy preserving identity exchange Web API
https://w3c-fedid.github.io/FedCM/
Other
375 stars 72 forks source link

Add support to show only top-level origin when calling from an iframe #464

Closed npm1 closed 1 year ago

npm1 commented 1 year ago

This PR fixes the client metadata fetch by passing the client ID in the query, and fixes https://github.com/fedidcg/FedCM/issues/449 by adding the proposed logic.

Preview | Diff

npm1 commented 1 year ago

Addressed comments, let me know what you think

yi-gu commented 1 year ago

Thanks! Algorithm LGTM.

npm1 commented 1 year ago

@martinthomson @cboozar @bvandersloot-mozilla please take a look. Per your request, not filing an official Mozilla standards position but you can consider this to be it. As discussed in the call, we would like to ship this on Chrome 115, which branches in May 23 so we'll send I2S perhaps a week or so before then.

cboozar commented 1 year ago

Makes sense to me, though I want to understand why the urgency for 115, who is consuming this ATM?

npm1 commented 1 year ago

Makes sense to me, though I want to understand why the urgency for 115, who is consuming this ATM?

I'm not merging this yet, as there are concerns about the API shape being discussed in the issue. The urgency for 115 is for Google Identity Services (right now, if they want a website to use FedCM within an iframe, Chrome will force the dialog to show three origins, whereas the site will most likely prefer showing only two if possible, to provide better UX). I'm not confident we'll be shipping in that milestone though, we'll keep people updated in the issue.

npm1 commented 1 year ago

I am closing this as we're not moving forward with this proposal.