FedCM Permissions Policy

[npm1]

Information about the spec

• Spec Title: Federated Credential Management API Permissions Policy
• Spec URL: https://fedidcg.github.io/FedCM/#permissions-policy-integration
• Explainer (if not README.md in the repository): https://github.com/fedidcg/FedCM/blob/main/explorations/iframe_support.md

Design reviews and vendor positions

• TAG Design Review:
• Mozilla standards-positions issue: FedCM Permissions Policy mozilla/standards-positions#701

Anything else we need to know

FedCM was considered positive here, and this request is only about the addition of permissions policy to enable iframes to invoke the API.

[annevk]

So when you have A embeds B, this would allow A to delegate the ability to invoke federated login to B. (A and B are cross-site.)

If successful this then gives the user identity to B and not A.

Given that this is equivalent to A and B collaborating through postMessage() to achieve the same result this is probably okay (and has a lot of precedent in other APIs), though I worry more than I used to about what kind of pressures will be put on A by sites commonly embedded to delegate all kinds of permissions.

cc @achristensen07

[marcoscaceres]

Closing in favor or #309 as we have never given a position of the actual FedCM spec.