Limited availability
Experimental: This is an experimental technology
Check the Browser compatibility table carefully before using this in production.
The Federated Credential Management API (or FedCM API) provides a standard mechanism for identity providers (IdPs) to make identity federation services available on the web in a privacy-preserving way, without the need for third-party cookies and redirects. This includes a JavaScript API that enables the use of federated authentication for activities such as signing in or signing up on a website.
FedCM conceptsIdentity federation is the delegation of user authentication from a website requiring user sign-up or sign-in, such as an e-commerce or social networking site (also known as a relying party or RP), to a trusted third-party identity provider (IdP) such as Google, Facebook/Meta, GitHub, etc.
RPs can integrate with IdPs, allowing users to sign-in using the accounts they have registered with the IdP. Identity federation via a small set of dedicated IdPs has improved web authentication in terms of security, consumer confidence, and user experience, as compared to each site managing its own sign-in needs with separate usernames and passwords.
The problem is that traditional identity federation relies on <iframe>s, redirects, and third-party cookies, which are also used for third-party tracking. Browsers are limiting the usage of these features in an effort to preserve user privacy, but a side effect is that this makes valid, non-tracking uses more difficult to implement, which includes identity federation.
This affects federated sign-in in general, as well as more specific identity federation use cases:
<iframe>s, which rely on RP cookies.<button> in the RP origin is implemented as an IdP <iframe> that requires third party cookies.FedCM aims to work around this problem, providing a dedicated mechanism for federated identity flows on the web, and enabling supporting browsers to provide special UI elements on RPs, allowing users to choose an IdP account to use for sign-in.
There are two parts to using the FedCM API, which are covered in the linked guides below:
navigator.credentials.get() method.Note: Google Sign In is an example of an IdP that already supports FedCM. Migrate to FedCM provides instructions for RPs wishing to migrate existing apps using Google Sign In to federated sign-in.
Permissions Policy integration and<iframe> support
The identity-credentials-get Permissions-Policy can be used to control permission to use FedCM. More specifically, it permits usage of the following methods:
Developers can explicitly grant permission for an <iframe> to use FedCM via the allow attribute:
<iframe src="3rd-party.example" allow="identity-credentials-get"></iframe>
The availability of FedCM within <iframe>s enables a couple of use cases:
<iframe>.<iframes> may themselves require federated authentication.IdentityCredential
Represents a user identity credential arising from successful federated authentication. A successful navigator.credentials.get() call that includes an identity option fulfills with an IdentityCredential instance.
IdentityProvider
Represents an IdP and provides access to related information and functionality.
NavigatorLogin
Defines login functionality for IdPs, including the Navigator.login.setStatus() method for updating IdP login status.
CredentialsContainer.get(), the identity option.
identity is an object containing details of federated IdPs that a relying party (RP) website can use to sign users in. It causes a get() call to initiate a request for a user to sign in to an RP with an IdP.
Navigator.login
Provides access to the browser's NavigatorLogin object.
Set-Login
Provides an HTTP mechanism for updating login status via HTTP.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4