Technical review: Add content on FedCM Login Status API, Error API and isAutoSelected #31521

chrisdavidmills · 2024-01-05T11:29:38Z

Note: This technical review is now completed and approved. For the follow-on editorial review, see #31658.

Description

Chrome 120 adds several updates to the FedCM API (see https://chromestatus.com/feature/5177628008382464 and https://chromestatus.com/feature/5384360374566912).

This PR adds/modifies:

The Login Status API:
- Navigator.login
- NavigatorStatus
- NavigatorStatus.setStatus()
- The Set-Login HTTP header
The Error API, which mainly manifests as useful properties of the return error object when a FedCM get() call rejects.
The Auto-Selected Flag, which mainly manifests as the IdentityCredential.isAutoSelected property.
IdentityProvider.close(), which is not part of the above ChromeStatuses, but is related and not documented, so I decided to deal with it as part of this workstream.

Note also:

I have taken this opportunity to split up the FedCM landing page into separate guides, as it was getting quite huge and unwieldy. The FedCM landing page now has two subpages, one that covered IdP integration, and one that covers the RP sign-in flow. These seem to work well as separate items.
I've included the Login Status API as a part of the IdP integration guide. There is an argument to put it in its own separate API tree, but currently, only FedCM uses it, and it is also part of the FedCM spec.

See also my research document for more details of what changes were added.

Motivation

Additional details

Fixes mdn/mdn#501

Related BCD update: mdn/browser-compat-data#21721

Related issues and pull requests

github-actions · 2024-01-05T11:31:09Z

Preview URLs (16 pages)

Flaws (4)

Note! 12 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Web/API/IdentityCredential/isAutoSelected
Title: IdentityCredential: isAutoSelected property
Flaw count: 1

bad_bcd_queries:
- No BCD data for query: api.IdentityCredential.isAutoSelected

URL: /en-US/docs/Web/API/Navigator
Title: Navigator
Flaw count: 1

macros:
- /en-US/docs/Web/API/Navigator/standalone does not exist

URL: /en-US/docs/Web/API/CredentialsContainer/get
Title: CredentialsContainer: get() method
Flaw count: 1

broken_links:
- No need for the pathname in anchor links if it's the same page

URL: /en-US/docs/Web/HTTP/Headers/Set-Login
Title: Set-Login
Flaw count: 1

bad_bcd_queries:
- No BCD data for query: http.headers.Set-Login

External URLs (11)

URL: /en-US/docs/Web/API/FedCM_API/IDP_integration
Title: Identity provider integration with FedCM

https://datatracker.ietf.org/doc/html/rfc6749 (1 time) (Note! This may be a new URL 👀)
https://developer.chrome.com/docs/privacy-sandbox/fedcm/ (1 time) (Note! This may be a new URL 👀)
https://developers.google.com/privacy-sandbox/blog/fedcm-chrome-120-updates (2 times) (Note! This may be a new URL 👀)
User identity associated with the RP should not be sent to the IDP before explicit consent is gathered fedidcg/FedCM#230 (1 time) (Note! This may be a new URL 👀)
Preventing silent timing attacks fedidcg/FedCM#447 (1 time) (Note! This may be a new URL 👀)
https://web.dev/articles/same-site-same-origin (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/API/FedCM_API/RP_sign-in
Title: Relying party federated sign-in

https://developer.chrome.com/docs/privacy-sandbox/fedcm/ (1 time) (Note! This may be a new URL 👀)
https://developers.google.com/privacy-sandbox/3pcd/fedcm (1 time) (Note! This may be a new URL 👀)
https://web.dev/articles/same-site-same-origin (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/API/IdentityCredential/isAutoSelected
Title: IdentityCredential: isAutoSelected property

https://developer.chrome.com/docs/privacy-sandbox/fedcm/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/API/IdentityProvider/close_static
Title: IdentityProvider: close() static method

https://developer.chrome.com/docs/privacy-sandbox/fedcm/ (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2024-01-11 10:32:58)

…ills/content into login-status-api-and-friends

files/en-us/web/api/credentialscontainer/get/index.md

files/en-us/web/api/fedcm_api/idp_integration/index.md

files/en-us/web/api/navigator/login/index.md

files/en-us/web/api/navigatorlogin/index.md

files/en-us/web/api/navigatorlogin/setstatus/index.md

files/en-us/web/http/headers/set-login/index.md

npm1

Looks great!

files/en-us/web/api/credentialscontainer/get/index.md

files/en-us/web/api/fedcm_api/idp_integration/index.md

files/en-us/web/api/fedcm_api/rp_sign-in/index.md

npm1

Looks good!

files/en-us/web/api/fedcm_api/idp_integration/index.md

chrisdavidmills · 2024-01-10T11:20:59Z

Thanks @npm1! We are close now. The only bits left now are a couple of clarifications/verifications:

Technical review: Add content on FedCM Login Status API, Error API and isAutoSelected #31521 (comment)
Technical review: Add content on FedCM Login Status API, Error API and isAutoSelected #31521 (comment)
Technical review: Add content on FedCM Login Status API, Error API and isAutoSelected #31521 (comment)

chrisdavidmills · 2024-01-10T18:14:09Z

Thanks again @npm1. I've gotten the last couple of fixes done before signing off tonight. Let me know if there is anything else you think this needs, or give me an LGTM, so we can get it put into editorial review tomorrow!

npm1

Just a couple more comments but LGTM

npm1 · 2024-01-10T18:38:16Z

files/en-us/web/api/fedcm_api/idp_integration/index.md

-| accounts_endpoint        | `GET`  | No           | Yes     | No        |
-| client_metadata_endpoint | `GET`  | Yes          | No      | Yes       |
-| id_assertion_endpoint    | `POST` | Yes          | Yes     | Yes       |
+| Endpoint/resource          | Method | Credentialed | Includes cookies | Includes {{httpheader("Origin")}} |


Sorry I missed that this table has 'credentialed' and 'includes cookies'. Those are the same thing? The Credentialed column is incorrect anyways so can we remove it?

OK, done. I also changed the column header to "Credentialed (with cookies)" just in case some people understand one, and some understand the other.

npm1 · 2024-01-10T18:45:43Z

files/en-us/web/api/fedcm_api/idp_integration/index.md

+
+## The `Sec-Fetch-Dest` HTTP header
+
+All requests sent from the browser via FedCM include a `{{httpheader("Sec-Fetch-Dest")}}: webidentity` header to prevent {{glossary("CSRF")}} attacks. All IdP endpoints must confirm this header is included. For example, the well-known file request would look like so:


We were discussing some issue with the team regarding this. In reality, while all endpoints have that Dest, it is only really important to check it on the credentialed (eg accounts and id assertion) endpoints. Perhaps we can update this to note that instead of saying all endpoints?

Makes sense - done! I also included the webidentity value on the actual Sec-Fetch-Destheader ref page, as I noticed it was missing.

chrisdavidmills · 2024-01-11T10:33:44Z

Great stuff, thanks @npm1. I'll get this passed into the editorial review stage (I'll create a new PR based on the same branch to contain that, so it doesn't become too busy).

files/en-us/web/api/fedcm_api/idp_integration/index.md

Add content on FedCM Login Status API, Error API and isAutoSelected

9b28693

chrisdavidmills requested review from a team as code owners January 5, 2024 11:29

chrisdavidmills requested review from Elchi3 and dipikabh and removed request for a team January 5, 2024 11:29

github-actions bot added Content:WebAPI Web API docs Content:HTTP HTTP docs labels Jan 5, 2024

chrisdavidmills changed the title ~~Add content on FedCM Login Status API, Error API and isAutoSelected~~ Technical review: Add content on FedCM Login Status API, Error API and isAutoSelected Jan 5, 2024

chrisdavidmills removed request for a team, Elchi3 and dipikabh January 5, 2024 11:35

chrisdavidmills added 4 commits January 5, 2024 11:57

Split FedCM landing page into separate guides

e5360ef

Merge branch 'main' into login-status-api-and-friends

0c309a8

Fix relative links broken by page moves

184e247

Merge branch 'login-status-api-and-friends' of github.com:chrisdavidm…

34c0fb0

…ills/content into login-status-api-and-friends

npm1 reviewed Jan 5, 2024

View reviewed changes

chrisdavidmills added 2 commits January 8, 2024 10:34

Merge branch 'main' into login-status-api-and-friends

69b5424

Add fixes for npm1 comments

2e7a731

chrisdavidmills requested a review from npm1 January 8, 2024 13:10

npm1 reviewed Jan 8, 2024

View reviewed changes

chrisdavidmills added 2 commits January 9, 2024 13:12

Fixes for second round of npm1 comments

7833505

Merge branch 'main' into login-status-api-and-friends

437a46c

chrisdavidmills requested a review from npm1 January 9, 2024 13:13

npm1 reviewed Jan 9, 2024

View reviewed changes

files/en-us/web/api/fedcm_api/idp_integration/index.md Outdated Show resolved Hide resolved

files/en-us/web/api/fedcm_api/idp_integration/index.md Outdated Show resolved Hide resolved

Fixes for 3rd round of npm1 comments

3530b52

Merge branch 'main' into login-status-api-and-friends

0c6c1b4

chrisdavidmills requested a review from npm1 January 10, 2024 11:21

Last couple of fixes

77e7ee6

Merge branch 'main' into login-status-api-and-friends

90e637c

npm1 reviewed Jan 10, 2024

View reviewed changes

chrisdavidmills added 2 commits January 11, 2024 10:31

Couple more fixes

fc3a41a

Merge branch 'main' into login-status-api-and-friends

1d8ad99

chrisdavidmills closed this Jan 11, 2024

chrisdavidmills mentioned this pull request Jan 11, 2024

feat: Editorial review: Login Status API and friends #31658

Merged

npm1 reviewed Jan 11, 2024

View reviewed changes

files/en-us/web/api/fedcm_api/idp_integration/index.md Show resolved Hide resolved

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Technical review: Add content on FedCM Login Status API, Error API and isAutoSelected #31521

Technical review: Add content on FedCM Login Status API, Error API and isAutoSelected #31521


		## The `Sec-Fetch-Dest` HTTP header

		All requests sent from the browser via FedCM include a `{{httpheader("Sec-Fetch-Dest")}}: webidentity` header to prevent {{glossary("CSRF")}} attacks. All IdP endpoints must confirm this header is included. For example, the well-known file request would look like so:

Technical review: Add content on FedCM Login Status API, Error API and isAutoSelected #31521

Technical review: Add content on FedCM Login Status API, Error API and isAutoSelected #31521

Conversation

Description

Motivation

Additional details

Related issues and pull requests

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment