From 6f8e7a4989d2c55eb7e56ae9aaec414048b0f723 Mon Sep 17 00:00:00 2001 From: Simone Onofri Date: Fri, 16 Aug 2024 17:27:01 +0000 Subject: [PATCH] FPWD preparation (#634) SHA: beadf81555b0d51cd53667661f091bafe57cfa46 Reason: push, by samuelgoto Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- index.html | 845 ++++++++++++++++++----------------------------------- 1 file changed, 287 insertions(+), 558 deletions(-) diff --git a/index.html b/index.html index 2982cef7..ebfa4767 100644 --- a/index.html +++ b/index.html @@ -1,12 +1,12 @@ - Federated Credential Management API - + Federated Credential Management API + - - + + - +

Federated Credential Management API

-

Draft Community Group Report,

-
-
-
This version: -
https://fedidcg.github.io/FedCM/ -
Test Suite: -
https://github.com/web-platform-tests/wpt/blob/master/credential-management/ -
Issue Tracking: -
GitHub -
Inline In Spec -
Editor: -
(Google Inc.) -
Former Editor: -
(Google Inc.) -
-
+

W3C First Public Working Draft,

+
+ More details about this document +
+
+
This version: +
https://www.w3.org/TR/2024/WD-fedcm-1-20240816/ +
Latest published version: +
https://www.w3.org/TR/fedcm/ +
Editor's Draft: +
https://w3c-fedid.github.io/FedCM/ +
History: +
https://www.w3.org/standards/history/fedcm-1/ +
Test Suite: +
https://github.com/web-platform-tests/wpt/blob/master/credential-management/ +
Feedback: +
GitHub +
Inline In Spec +
Editor: +
(Google Inc.) +
Former Editor: +
(Google Inc.) +
+
+
-

Copyright © 2024 the Contributors to the Federated Credential Management API Specification, published by the Federated Identity Community Group under the W3C Community Contributor License Agreement (CLA). -A human-readable summary is available.

+

Copyright © 2024 World Wide Web Consortium. W3C® liability, trademark and permissive document license rules apply.

Abstract

A Web Platform API that allows users to login to websites with their federated accounts in a privacy preserving manner.

-
-

Status of this document

+

Status of this document

-

This specification was published by the Federated Identity Community Group. - It is not a W3C Standard nor is it on the W3C Standards Track. - - Please note that under the W3C Community Contributor License Agreement (CLA) there is a limited opt-out and other conditions apply. - - Learn more about W3C Community and Business Groups.

+

This section describes the status of this document at the time of + its publication. A list of + current W3C publications and the latest revision of this technical report + can be found in the W3C technical reports + index at https://www.w3.org/TR/.

+

This document was published by the Federated Identity Working Group as a First Public Working Draft using the Recommendation + track. This document is intended to become a W3C Recommendation.

+

The (archived) public mailing list public-fedid-wg@w3.org (see instructions) + is preferred for discussion of this specification. + When sending e-mail, + please put the text “fedcm” in the subject, + preferably like this: + “[fedcm] …summary of comment…”

+

This document is a First Public Working Draft.

+

Publication as a First Public Working Draft does not imply endorsement by W3C and its Members. This is a draft document and may be updated, replaced or + obsoleted by other documents at any time. It is inappropriate to cite this + document as other than work in progress.

+

This document was produced by the Federated Identity Working Group.

+

This document was produced by a group operating under + the W3C Patent Policy. + W3C maintains a public list of any patent disclosures made in connection with the deliverables of the group; + that page also includes instructions for disclosing a patent. + An individual who has actual knowledge of a patent which the individual believes contains Essential Claim(s) must disclose the information in accordance with section 6 of the W3C Patent Policy.

+

This document is governed by the 03 November 2023 W3C Process Document.

@@ -1044,6 +850,7 @@

Table of Contents

Conformance
  1. Document conventions +
  2. Conformant Algorithms
  • Index @@ -1375,12 +1182,12 @@

    Note: The user agent MAY want to reset the state to unknown, since is impossible to know whether this cookie affects authorization state.

    -
    the user agent receives a Clear-Site-Data header with a +
    the user agent receives a Clear-Site-Data header with a value of "cookies" or "*", and the request's client is not null, and the client’s origin is same origin with the top-level origin
    -

    while clearing cookies for +

    while clearing cookies for origin it MUST remove any entries in the Login Status Map where the key is the input origin.

    Once Clear-Site-Data supports partitioned cookies, @@ -1465,22 +1272,22 @@

    2.3. The IdentityCredential Interface

    -

    This specification introduces a new type of Credential, called an IdentityCredential:

    +

    This specification introduces a new type of Credential, called an IdentityCredential:

    dictionary IdentityCredentialDisconnectOptions : IdentityProviderConfig {
   required USVString accountHint;
 };
 
 [Exposed=Window, SecureContext]
-interface IdentityCredential : Credential {
+interface IdentityCredential : Credential {
   static Promise<undefined> disconnect(optional IdentityCredentialDisconnectOptions options = {});
   readonly attribute USVString? token;
   readonly attribute boolean isAutoSelected;
 };
    -
    id +
    id
    -

    The id's attribute getter returns the empty string.

    +

    The id's attribute getter returns the empty string.

    token

    The token's attribute getter returns the value it is set to. @@ -1490,12 +1297,12 @@

    isAutoSelected's attribute getter returns the value it is set to. It represents whether the user’s identity credential was automatically selected when going through the UI flow which resulted in this IdentityCredential.

    -
    [[type]] +
    [[type]]
    -

    The IdentityCredential's [[type]]'s value is "identity".

    -
    [[discovery]] +

    The IdentityCredential's [[type]]'s value is "identity".

    +
    [[discovery]]
    -

    The IdentityCredential's [[discovery]]'s value is remote.

    +

    The IdentityCredential's [[discovery]]'s value is remote.

    The main entrypoint in this specification is through the entrypoints exposed by the Credential Management API.

    @@ -1508,7 +1315,7 @@

    associated Document.

  • -

    If document is not allowed to use the identity-credentials-get policy-controlled feature, throw a "NotAllowedError" DOMException.

    +

    If document is not allowed to use the identity-credentials-get policy-controlled feature, throw a "NotAllowedError" DOMException.

  • Let promise be a new Promise.

  • @@ -1527,13 +1334,13 @@

    reject promise with an "InvalidStateError" DOMException.

  • -

    Run a Content Security Policy Level 3 check with a connect-src directive on the URL +

    Run a Content Security Policy Level 3 check with a connect-src directive on the URL passed as configUrl. If it fails, reject promise with a "NetworkError" DOMException.

  • If there is another pending disconnect call for this globalObject (e.g., it has not yet thrown an exception or its associated Promise has not yet been resolved), reject promise with a "NetworkError" DOMException.

  • -

    If configUrl is not a potentially trustworthy origin, reject promise with a +

    If configUrl is not a potentially trustworthy origin, reject promise with a "NetworkError" DOMException.

  • If the user has disabled the FedCM API on the globalObject, reject promise with a @@ -1670,8 +1477,8 @@

    CredentialRequestOptions object:

    -
    partial dictionary CredentialRequestOptions {
+   
    This specification introduces an extension to the CredentialRequestOptions object:
    
+
    partial dictionary CredentialRequestOptions {
   IdentityCredentialRequestOptions identity;
 };
 
    
@@ -1728,25 +1535,25 @@ 
    2.3.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method
    
-   
    The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) algorithm runs in parallel inside Credential Management 1 § 2.5.1 Request a Credential to request
+   
    The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) algorithm runs in parallel inside Credential Management 1 § 2.5.1 Request a Credential to request
 credentials and returns an IdentityCredential or an error.
    
    
    This internal method accepts three arguments:
    
    
    
     
    origin
     
    
      
    This argument is the relevant settings object's origin, as determined by the
- calling get() implementation, i.e., CredentialsContainer's Request a Credential abstract operation.
    
+ calling get() implementation, i.e., CredentialsContainer's Request a Credential abstract operation.
    
     
    options
     
    
-     
    This argument is a CredentialRequestOptions object whose identity member exists.
    
+     
    This argument is a CredentialRequestOptions object whose identity member exists.
    
     
    sameOriginWithAncestors
     
    
      
    This argument is a Boolean value which is true if and only if the
  caller’s environment settings object is same-origin with its ancestors. It is false if caller is cross-origin.
    
-     
    Note: Invocation of this internal method indicates that it was allowed by permissions policy, which is evaluated at the Credential Management Level 1 level.
+     
    Note: Invocation of this internal method indicates that it was allowed by permissions policy, which is evaluated at the Credential Management Level 1 level.
 See § 4 Permissions Policy Integration. As such, sameOriginWithAncestors is unused.
    
    
    
-   
    The options.signal is used as an abort signal for the
+   
    The options.signal is used as an abort signal for the
 requests.
    
    
    
      When the IdentityCredential's [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) algorithm is invoked, the user agent MUST execute the following steps. This returns an IdentityCredential (or throws an error to the caller). 
@@ -1756,7 +1563,7 @@ 
    
       
    If the size of options["identity"]["providers"]
 is not equal to 1, queue a global task on the DOM manipulation task source given globalObject to throw a new "NetworkError" DOMException
    
-      
    Note: The globalObject is not currently passed onto the [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) algorithm. See issue.
    
+      
    Note: The globalObject is not currently passed onto the [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) algorithm. See issue.
    
       
     Support choosing accounts from multiple IDPs, as described here.
    
      
  • 
       
    The user agent can decide when to continue with the next steps.
    
@@ -1802,7 +1609,7 @@ 
    <
    
    The create an IdentityCredential algorithm invokes the various FedCM fetches, shows the user
 agent UI, and creates the IdentityCredential that is then returned to the RP.
    
    
    
-     To create an IdentityCredential given an IdentityProviderRequestOptions provider, a CredentialRequestOptions options, and a globalObject, run the following steps. This returns an IdentityCredential or a pair (failure, bool), where the bool indicates whether to skip delaying
+     To create an IdentityCredential given an IdentityProviderRequestOptions provider, a CredentialRequestOptions options, and a globalObject, run the following steps. This returns an IdentityCredential or a pair (failure, bool), where the bool indicates whether to skip delaying
 the exception thrown. 
     
      
      
    1. 
@@ -1844,10 +1651,10 @@ 
      <
      
    2. 
       
      Let requiresUserMediation be provider’s configURL's origin's requires user mediation.
      
      
    3. 
-      
      Let mediation be options’s mediation.
      
+      
      Let mediation be options’s mediation.
      
      
    4. 
       
      If requiresUserMediation is true and mediation is
-"silent", return (failure, true).
      
+"silent", return (failure, true).
      
      
    5. 
       
      Let config be the result of running fetch the config file with provider and globalObject.
      
      
    6. 
@@ -1953,7 +1760,7 @@ 
      <
      
    7. 
       
      Let permission, disclosureTextShown, and isAutoSelected be set to false.
      
      
    8. 
-      
      If mediation is not "required", requiresUserMediation is false, and numRegisteredAccounts is equal to 1:
      
+      
      If mediation is not "required", requiresUserMediation is false, and numRegisteredAccounts is equal to 1:
      
       
        
        
      1. 
         
        Set account to registeredAccount and accountState to the result of running compute the connection status algorithm given provider and account. When doing this,
@@ -1962,7 +1769,7 @@ 
        <
         
        Set isAutoSelected to true.
        
       
      
      
    9. 
-      
      Otherwise, if mediation is "silent", return (failure, true).
      
+      
      Otherwise, if mediation is "silent", return (failure, true).
      
      
    10. 
       
      Otherwise, if accountsList’s size is 1:
      
       
        
@@ -2024,10 +1831,10 @@ 
        
       
        If configUrl is failure, return failure.
        
      
      1. 
-      
        Run a Content Security Policy Level 3 check with a connect-src directive on the URL
+      
        Run a Content Security Policy Level 3 check with a connect-src directive on the URL
 passed as configUrl. If it fails, return failure.
        
      
      2. 
-      
        If configUrl is not a potentially trustworthy URL, return failure.
        
+      
        If configUrl is not a potentially trustworthy URL, return failure.
        
      
      3. 
       
        Let rootUrl be a new URL.
        
      
      4. 
@@ -2590,7 +2397,7 @@ 
        
       
        If manifestUrl is not same origin with configUrl, return failure.
        
      
      5. 
-      
        If manifestUrl is not a potentially trustworthy URL, return failure.
        
+      
        If manifestUrl is not a potentially trustworthy URL, return failure.
        
      
      6. 
       
        Return manifestUrl.
        
     
      
@@ -2726,7 +2533,7 @@ 
      associated Document.
      
      
    11. 
-      
      If document is not allowed to use the identity-credentials-get policy-controlled feature, throw a "NotAllowedError" DOMException.
      
+      
      If document is not allowed to use the identity-credentials-get policy-controlled feature, throw a "NotAllowedError" DOMException.
      
      
    12. 
       
      If there does not exist an account account such that compute the connection status of provider, account, and globalObject returns connected, then throw a new "NetworkError" DOMException. This check can be performed by iterating over the connected accounts set or by keeping a separate data structure to make this lookup fast.
      
      
    13. 
@@ -2737,7 +2544,7 @@ 
      origin is not same origin as configUrl’s origin,
 throw an "InvalidStateError" DOMException.
      
      
    14. 
-      
      Run a Content Security Policy Level 3 check with a connect-src directive on the URL
+      
      Run a Content Security Policy Level 3 check with a connect-src directive on the URL
 passed as configUrl. If it fails, throw a new "NetworkError" DOMException.
      
      
    15. 
       
      If globalObject’s navigable is a top-level traversable, throw a new
@@ -2822,7 +2629,7 @@ 
      3. <
 to execute these in such a way that it does not allow the user to be tracked (by an attacker
 impersonating an IDP) on to the site using FedCM. The following table has information about the
 network requests performed:
      
-   
+   
      
     
      
      
       Endpoint
@@ -2860,7 +2667,7 @@ 
      The IDP exposes a well-known file in a pre-defined location, specifically at the "web-identity" file at the IDPs's path ".well-known".
      
    
      The well-known file is fetched in the fetch the config file algorithm:
      
    
      (a) without cookies,
-(b) with the Sec-Fetch-Dest header set to webidentity, and
+(b) with the Sec-Fetch-Dest header set to webidentity, and
 (c) without revealing the RP in the Origin or Referer headers.
      
    
      For example:
      
    
      
@@ -2882,7 +2689,7 @@ 
      The config file serves as a discovery device to other endpoints provided by the IDP.
      
    
      The config file is fetched in the fetch the config file algorithm:
      
    
      (a) without cookies,
-(b) with the Sec-Fetch-Dest header set to webidentity,
+(b) with the Sec-Fetch-Dest header set to webidentity,
 (c) without revealing the RP in the Origin or Referer headers, and
 (d) without following HTTP redirects.
      
    
      For example:
      
@@ -2953,7 +2760,7 @@ 
      user agent may choose to not display it at
 all, trim the icon and show a square portion of it, or even transform it into a square icon and show
 that.
      
-   
      The color is a subset of CSS <color> syntax, namely <hex-color>s, hsl()s, rgb()s and <named-color>.
      
+   
      The color is a subset of CSS <color> syntax, namely <hex-color>s, hsl()s, rgb()s and <named-color>.
      
    
      For example:
      
    
      
      
@@ -2978,7 +2785,7 @@ 
      The accounts endpoint provides the list of accounts the user has at the IDP.
      
    
      The accounts endpoint is fetched in the fetch the accounts algorithm:
      
    
      (a) with IDP cookies,
-(b) with the Sec-Fetch-Dest header set to webidentity,
+(b) with the Sec-Fetch-Dest header set to webidentity,
 (c) without revealing the RP in the Origin or Referer headers, and
 (d) without following HTTP redirects.
      
    
      For example:
      
@@ -3056,7 +2863,7 @@ 
      client metadata endpoint provides metadata about RPs.
      
    
      The client metadata endpoint is fetched in the fetch the client metadata algorithm:
      
    
      (a) without cookies,
-(b) with the Sec-Fetch-Dest header set to webidentity,
+(b) with the Sec-Fetch-Dest header set to webidentity,
 (c) with the RP's origin in the Origin header, and
 (d) without following HTTP redirects.
      
    
      The user agent also passes the client_id.
      
@@ -3095,7 +2902,7 @@ 
      
    
      (a) as a POST request,
 (b) with IDP cookies,
 (c) with the RP's origin in the Origin header, and
-(d) with the Sec-Fetch-Dest header set to webidentity,
+(d) with the Sec-Fetch-Dest header set to webidentity,
 (e) without following HTTP redirects.
      
    
      It will also contain the following parameters in the request body application/x-www-form-urlencoded:
      
    
      
@@ -3161,7 +2968,7 @@ 
      (a) as a POST request,
 (b) with IDP cookies,
 (c) with the RP's origin in the Origin header,
-(d) with the Sec-Fetch-Dest header set to webidentity,
+(d) with the Sec-Fetch-Dest header set to webidentity,
 (e) without following HTTP redirects, and
 (f) in "cors" mode.
      
    
      It will also contain the following in the request body application/x-www-form-urlencoded:
      
@@ -3196,23 +3003,23 @@ 
      user agent does not find the account with the ID provided by the IDP, then all accounts
 associated with the relevant (RP, IDP) are removed from the connected accounts set.
      
    
      4. Permissions Policy Integration
      
-   
      FedCM defines a policy-controlled feature identified by the string "identity-credentials-get".
-Its default allowlist is "self".
      
+   
      FedCM defines a policy-controlled feature identified by the string "identity-credentials-get".
+Its default allowlist is "self".
      
    
      A Document’s permissions policy determines whether any content
 in that document is allowed to obtain a credential object using the Browser API.
-Attempting to invoke navigator.credentials.get({identity:..., ...}) in documents that are not allowed to use the identity-credentials-get feature will result
+Attempting to invoke navigator.credentials.get({identity:..., ...}) in documents that are not allowed to use the identity-credentials-get feature will result
 in a promise rejected with a "NotAllowedError" DOMException.
      
    
      This restriction can be controlled using the mechanisms described in Permissions Policy.
      
-   
      Note: Algorithms specified in Credential Management Level 1 perform the actual
+   
      Note: Algorithms specified in Credential Management Level 1 perform the actual
 permissions policy evaluation. This is because such policy evaluation needs to
 occur when there is access to the current settings object. The internal methods
-modified by this specification do not have such access since they are invoked in parallel by CredentialsContainer's Request a Credential abstract operation.
      
+modified by this specification do not have such access since they are invoked in parallel by CredentialsContainer's Request a Credential abstract operation.
      
    
      5. User Agent Automation
      
    
      For the purposes of user agent automation and website testing, this document
-defines the below WebDriver extension commands to interact with any
+defines the below WebDriver extension commands to interact with any
 active FedCM dialogs.
      
    
      5.1. Extension capability
      
-   
      In order to advertise the availability of the extension commands defined below, a new extension capability is defined.
      
+   
      In order to advertise the availability of the extension commands defined below, a new extension capability is defined.
      
    
      
     
@@ -3232,7 +3039,7 @@ 
      When validating capabilities, the extension-specific substeps to validate "fedcm:accounts" with value are the following:
      
    
        
     
      1. 
-     
        If value is not a boolean return a WebDriver Error with error code invalid argument.
        
+     
        If value is not a boolean return a WebDriver Error with error code invalid argument.
        
     
      2. 
      
        Otherwise, let deserialized be set to value.
        
    
      
@@ -3257,15 +3064,15 @@ 
      /session/{session id}/fedcm/canceldialog
     
      
      
      
    
      
-   
      The remote end steps are:
      
+   
      The remote end steps are:
      
    
        
     
      1. 
-     
        If no FedCM dialog is currently open, return a WebDriver error with error code no such alert.
        
+     
        If no FedCM dialog is currently open, return a WebDriver error with error code no such alert.
        
     
      2. 
      
        Close the dialog and continue the create an IdentityCredential algorithm
 as if the user had canceled the dialog without choosing an account.
        
     
      3. 
-     
        Return success with data null.
        
+     
        Return success with data null.
        
    
      
    
      5.3. Select account
      
    
      
@@ -3280,23 +3087,23 @@ 
      /session/{session id}/fedcm/selectaccount
     
      
    
-   
      The remote end steps are:
      
+   
      The remote end steps are:
      
    
        
     
      1. 
-     
        If parameters is not a JSON Object, return a WebDriver error with error code invalid argument.
        
+     
        If parameters is not a JSON Object, return a WebDriver error with error code invalid argument.
        
     
      2. 
-     
        If no FedCM dialog is currently open, return a WebDriver error with error code no such alert.
        
+     
        If no FedCM dialog is currently open, return a WebDriver error with error code no such alert.
        
     
      3. 
      
        Let accountIndex be the result of getting a property named "accountIndex" from parameters.
        
     
      4. 
      
        If accountIndex is undefined or is less than 0 or greater than or
 equal to the number of accounts that the user can choose from in the
-current flow, return a WebDriver error with error code invalid argument.
        
+current flow, return a WebDriver error with error code invalid argument.
        
     
      5. 
      
        Close the dialog and continue the create an IdentityCredential algorithm
 as if the user had selected the account indicated by accountIndex and granted permission to sign-up, if applicable.
        
     
      6. 
-     
        Return success with data null.
        
+     
        Return success with data null.
        
    
      
    
      5.4. Click dialog button
      
    
      
@@ -3311,24 +3118,24 @@ 
      /session/{session id}/fedcm/clickdialogbutton
     
    
      
-   
      The remote end steps are:
      
+   
      The remote end steps are:
      
    
        
     
      1. 
-     
        If parameters is not a JSON Object, return a WebDriver error with error code invalid argument.
        
+     
        If parameters is not a JSON Object, return a WebDriver error with error code invalid argument.
        
     
      2. 
      
        Let dialogButton be the result of getting a property named "dialogButton" from parameters.
        
     
      3. 
      
        If dialogButton is not a string that is "ConfirmIdpLoginContinue", return
-a WebDriver error with error code invalid argument.
        
+a WebDriver error with error code invalid argument.
        
     
      4. 
      
        If no FedCM dialog is currently open or the dialog is not a confirm IDP
-login dialog, return a WebDriver error with error code no
+login dialog, return a WebDriver error with error code no
 such alert.
        
     
      5. 
      
        Act as if the user had clicked the "continue" button in the confirm IDP
 login dialog and initiate the login flow.
        
     
      6. 
-     
        Return success with data null.
        
+     
        Return success with data null.
        
    
      
    
      5.5. Account list
      
    
      
@@ -3343,10 +3150,10 @@ 
      /session/{session id}/fedcm/accountlist
     
    
      
-   
      The remote end steps are:
      
+   
      The remote end steps are:
      
    
        
     
      1. 
-     
        If no FedCM dialog is currently open, return a WebDriver error with error code no such alert.
        
+     
        If no FedCM dialog is currently open, return a WebDriver error with error code no such alert.
        
     
      2. 
      
        Let accounts be the list of accounts that the user can or could choose
 from in the current flow.
        
@@ -3384,7 +3191,7 @@ 
        
      
      
     
    16. 
-     
      Return success with data list.
      
+     
      Return success with data list.
      
    
    
    
    5.6. Get title
    
    
    
@@ -3400,10 +3207,10 @@ 
    
    
    
    
    Note: This command lets automation verify that the context api was applied properly
    
-   
    The remote end steps are:
    
+   
    The remote end steps are:
    
    
      
     
    1. 
-     
      If no FedCM dialog is currently open, return a WebDriver error with error code no such alert.
      
+     
      If no FedCM dialog is currently open, return a WebDriver error with error code no such alert.
      
     
    2. 
      
      Let data be a dictionary with an object with properties as follows:
      
      
        
@@ -3413,7 +3220,7 @@ 
        subtitle set to the subtitle of the open dialog, if there is one
        
      
      
     
    3. 
-     
      Return success with data data.
      
+     
      Return success with data data.
      
    
    
    
    5.7. Get dialog type
    
    
    
@@ -3428,16 +3235,16 @@ 
    /session/{session id}/fedcm/getdialogtype
     
    
    
-   
    The remote end steps are:
    
+   
    The remote end steps are:
    
    
      
     
    1. 
-     
      If no FedCM dialog is currently open, return a WebDriver error with error code no such alert.
      
+     
      If no FedCM dialog is currently open, return a WebDriver error with error code no such alert.
      
     
    2. 
      
      Let type be a string that is "AutoReauthn" if the user is being auto-reauthenticated,
 or "AccountChooser" if the dialog is an account chooser, or "ConfirmIdpLogin" if the
 dialog is a confirm IDP login dialog.
      
     
    3. 
-     
      Return success with data type.
      
+     
      Return success with data type.
      
    
    
    
    5.8. Set delay enabled
    
    
    
@@ -3452,19 +3259,19 @@ 
    /session/{session id}/fedcm/setdelayenabled
     
    
    
-   
    The remote end steps are:
    
+   
    The remote end steps are:
    
    
      
     
    1. 
-     
      If parameters is not a JSON Object, return a WebDriver error with error code invalid argument.
      
+     
      If parameters is not a JSON Object, return a WebDriver error with error code invalid argument.
      
     
    2. 
      
      Let enabled be the result of getting a property named "enabled" from parameters.
      
     
    3. 
-     
      If enabled is undefined or is not a boolean, return a WebDriver error with error code invalid argument.
      
+     
      If enabled is undefined or is not a boolean, return a WebDriver error with error code invalid argument.
      
     
    4. 
      
      If enabled is false, disables the promise rejection delay; otherwise,
 re-enables it.
      
     
    5. 
-     
      Return success with data null.
      
+     
      Return success with data null.
      
    
    
    
    5.9. Reset cooldown
    
    
    
@@ -3479,14 +3286,14 @@ 
    /session/{session id}/fedcm/resetcooldown
     
    
    
-   
    The remote end steps are:
    
+   
    The remote end steps are:
    
    
      
     
    1. 
      
      If the user agent uses a cooldown delay, which disables the API for an
 amount of time after the user dismissed the dialog, then this command
 resets that cooldown such that the next FedCM call can succeed again.
      
     
    2. 
-     
      Return success with data null.
      
+     
      Return success with data null.
      
    
    
    
    6. Security
    
    
    This section provides a few of the security considerations for the FedCM API. Note that there is a
@@ -3496,15 +3303,15 @@ 
    IDP, one which is not trusted by the RP. If the
 call is successful, this would introduce browser UI on the RP with sign in options into a
 malicious IDP. This maliciousIDP could then attempt to trick the user. The protection
-against this attack is the Content Security Policy Level 3 check, which would fail because the origin of the manifest of
-the malicious IDP would not be an origin included in the allowlist specified by the Content Security Policy Level 3 of
+against this attack is the Content Security Policy Level 3 check, which would fail because the origin of the manifest of
+the malicious IDP would not be an origin included in the allowlist specified by the Content Security Policy Level 3 of
 the RP, hence preventing the undesired FedCM UI from being shown. Since any subsequent fetches
 are same origin with respect to the config file or at least dependent on the contents of the config file, they do not require additional checks.
    
-   
    The non-same-origin fetches include, for example, the brand icon. The user agent does not perform a Content Security Policy Level 3 check on these because they are directly specified from the manifest. In addition, the
+   
    The non-same-origin fetches include, for example, the brand icon. The user agent does not perform a Content Security Policy Level 3 check on these because they are directly specified from the manifest. In addition, the
 rendering of this image is performed by the user agent, and as such this image cannot affect the RP site nor can they be inspected by the RP in any way.
    
    
    6.2. Sec-Fetch-Dest Header
    
    
    The FedCM API introduces several non-static endpoints on the IDP, so these need to be protected
-from XSS attacks. In order to do so, the FedCM API introduces a new value for the Sec-Fetch-Dest header, a forbidden request-header. The requests initiated by the FedCM API
+from XSS attacks. In order to do so, the FedCM API introduces a new value for the Sec-Fetch-Dest header, a forbidden request-header. The requests initiated by the FedCM API
 have a webidentity value for this header. The value cannot be set by random websites, so the IDP can be confident that the request was originated by the FedCM browser rather than sent by a
 websites trying to run an XSS attack. An IDP needs to check for this header’s value in the
 credentialed requests it receives, which ensures that the request was initiated by the user agent,
@@ -3715,7 +3522,7 @@ 
    
-    
+    
      
       
        
@@ -3769,7 +3576,7 @@ 
    
        
        
-        
+        
        
        
        
@@ -3815,7 +3622,7 @@ 
    
        
        
-        
+        
        
        
        
@@ -3834,7 +3641,7 @@ 
    
+      
      
     
    
    
@@ -3847,7 +3654,7 @@ 
    user
 agent’s or IDP’s view.
    
    
    
-    
+    
      
       
       
@@ -3894,7 +3701,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -3904,7 +3711,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -3921,7 +3728,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -3931,7 +3738,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -3943,7 +3750,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -3953,7 +3760,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -3973,7 +3780,7 @@ 
    
      
      
-      
+      
      
     
    
    
@@ -4006,7 +3813,7 @@ 
    IDP, and the RP. These identifiers would be
 unique, and hence it would not be possible to correlate these with other RPs.
    
    
    
-    
+    
      
       
       
@@ -4044,7 +3851,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -4084,7 +3891,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -4133,7 +3940,7 @@ 
    
       
-       
+       
       
       
       
@@ -4142,7 +3949,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -4209,7 +4016,7 @@ 
    
      
      
-      
+      
       
      
     
@@ -4226,7 +4033,7 @@ 
    RP. And the user should be
 able to rescind the access to that identification, for instance by logging out. However, a tracking RP could keep state to detect the user that was previously logged in:
    
    
    
-    
+    
      
       
       
@@ -4266,11 +4073,11 @@ 
    
       
       
-       
+       
       
      
      
-      
+      
      
     
    
    
@@ -4286,7 +4093,7 @@ 
    IDP does not having pre-existing user account
 information (for instance, if it is not a _bona fide_ IDP), because FedCM requests sent to the IDP are credentialed. This is more likely to occur if the RP is colluding with the IDP to enable tracking via § 7.3.2 Timing Attacks.
    
    
    
-    
+    
      
       
       
@@ -4312,7 +4119,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -4347,7 +4154,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -4388,8 +4195,8 @@ 
    
      
      
-      
-      
+      
+      
      
     
    
    
@@ -4415,7 +4222,7 @@ 
    personas).
 These schemes have not been adopted by this specification.
    
    
    
-    
+    
      
       
       
@@ -4458,7 +4265,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -4501,7 +4308,7 @@ 
    
       
       
-       
+       
       
       
       
@@ -4511,7 +4318,7 @@ 
    
      
      
-      
+      
      
     
    
    
@@ -4522,38 +4329,36 @@ 
    10. FPWD Issues
    
     Note: The WG has labeled the following issues as critical open issues that must be formally addressed before publication of a Candidate Recommendation. 
    
   
   
    
@@ -4582,6 +4387,22 @@ 
    ,
     like this: 
    
    
    Note, this is an informative note.
    
+   
    
+    
    Conformant Algorithms
    
+    
    Requirements phrased in the imperative as part of algorithms
+    (such as "strip any leading space characters"
+    or "return false and abort these steps")
+    are to be interpreted with the meaning of the key word
+    ("must", "should", "may", etc)
+    used in introducing the algorithm. 
    
+    
    Conformance requirements phrased as algorithms or specific steps
+    can be implemented in any manner,
+    so long as the end result is equivalent.
+    In particular, the algorithms defined in this specification
+    are intended to be easy to understand
+    and are not intended to be performant.
+    Implementers are encouraged to optimize. 
    
+   
    
   
    
 
   
    Index
    
@@ -4732,41 +4553,41 @@ 
    
     [CLEAR-SITE-DATA] defines the following terms:
     
      
-     
    • clear cookies for origin
-     
    • clear-site-data
+     
    • clear cookies for origin
+     
    • clear-site-data
     
    
    
  • 
     [CREDENTIAL-MANAGEMENT-1] defines the following terms:
     
      
-     
    • Credential
-     
    • CredentialRequestOptions
-     
    • CredentialsContainer
-     
    • Request a Credential
-     
    • [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)
-     
    • [[discovery]]
-     
    • [[type]]
-     
    • get()
-     
    • id
-     
    • mediation
-     
    • remote
-     
    • required
+     
    • Credential
+     
    • CredentialRequestOptions
+     
    • CredentialsContainer
+     
    • Request a Credential
+     
    • [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)
+     
    • [[discovery]]
+     
    • [[type]]
+     
    • get()
+     
    • id
+     
    • mediation
+     
    • remote
+     
    • required
      
    • requires user mediation
      
    • same-origin with its ancestors
-     
    • signal
-     
    • silent
+     
    • signal
+     
    • silent
     
    
    
  • 
     [CSS-COLOR-4] defines the following terms:
     
      
-     
    • <hex-color>
-     
    • <named-color>
-     
    • hsl()
-     
    • rgb()
+     
    • <hex-color>
+     
    • <named-color>
+     
    • hsl()
+     
    • rgb()
     
    
    
  • 
     [CSS-COLOR-5] defines the following terms:
     
      
-     
    • <color>
+     
    • <color>
     
    
    
  • 
     [CSSOM-VIEW-1] defines the following terms:
@@ -4827,7 +4648,7 @@ 
    
     [FETCH-METADATA] defines the following terms:
     
      
-     
    • sec-fetch-dest
+     
    • sec-fetch-dest
     
    
    
  • 
     [HTML] defines the following terms:
@@ -4890,14 +4711,14 @@ 
    
     [PERMISSIONS-POLICY-1] defines the following terms:
     
      
-     
    • default allowlist
-     
    • policy-controlled feature
+     
    • default allowlist
+     
    • policy-controlled feature
     
    
    
  • 
     [SECURE-CONTEXTS] defines the following terms:
     
      
-     
    • potentially trustworthy origin
-     
    • potentially trustworthy url
+     
    • potentially trustworthy origin
+     
    • potentially trustworthy url
     
    
    
  • 
     [URL] defines the following terms:
@@ -4926,11 +4747,11 @@ 
    
     [WebDriver2] defines the following terms:
     
      
-     
    • error
-     
    • extension commands
-     
    • invalid argument
-     
    • remote end steps
-     
    • success
+     
    • error
+     
    • extension commands
+     
    • invalid argument
+     
    • remote end steps
+     
    • success
     
    
    
  • 
     [WEBIDL] defines the following terms:
@@ -4960,17 +4781,17 @@ 
    
   
    Normative References
    
   
    
    
    [CLEAR-SITE-DATA]
-   
    Mike West. Clear Site Data. URL: https://w3c.github.io/webappsec-clear-site-data/
+   
    Mike West. Clear Site Data. 30 November 2017. WD. URL: https://www.w3.org/TR/clear-site-data/
    
    [CREDENTIAL-MANAGEMENT-1]
-   
    Nina Satragno; Marcos Caceres. Credential Management Level 1. URL: https://w3c.github.io/webappsec-credential-management/
+   
    Nina Satragno; Marcos Caceres. Credential Management Level 1. 13 August 2024. WD. URL: https://www.w3.org/TR/credential-management-1/
    
    [CSP]
-   
    Mike West; Antonio Sartori. Content Security Policy Level 3. URL: https://w3c.github.io/webappsec-csp/
+   
    Mike West; Antonio Sartori. Content Security Policy Level 3. 18 June 2024. WD. URL: https://www.w3.org/TR/CSP3/
    
    [CSS-COLOR-4]
-   
    Chris Lilley; Tab Atkins Jr.; Lea Verou. CSS Color Module Level 4. URL: https://drafts.csswg.org/css-color-4/
+   
    Chris Lilley; Tab Atkins Jr.; Lea Verou. CSS Color Module Level 4. 13 February 2024. CR. URL: https://www.w3.org/TR/css-color-4/
    
    [CSS-COLOR-5]
-   
    Chris Lilley; et al. CSS Color Module Level 5. URL: https://drafts.csswg.org/css-color-5/
+   
    Chris Lilley; et al. CSS Color Module Level 5. 29 February 2024. WD. URL: https://www.w3.org/TR/css-color-5/
    
    [CSSOM-VIEW-1]
-   
    Simon Pieters. CSSOM View Module. URL: https://drafts.csswg.org/cssom-view/
+   
    Simon Pieters. CSSOM View Module. 17 March 2016. WD. URL: https://www.w3.org/TR/cssom-view-1/
    
    [DOM]
    
    Anne van Kesteren. DOM Standard. Living Standard. URL: https://dom.spec.whatwg.org/
    
    [ECMASCRIPT]
@@ -4980,7 +4801,7 @@ 
    N
    
    [FETCH]
    
    Anne van Kesteren. Fetch Standard. Living Standard. URL: https://fetch.spec.whatwg.org/
    
    [FETCH-METADATA]
-   
    Mike West. Fetch Metadata Request Headers. URL: https://w3c.github.io/webappsec-fetch-metadata/
+   
    Mike West. Fetch Metadata Request Headers. 31 October 2023. WD. URL: https://www.w3.org/TR/fetch-metadata/
    
    [HTML]
    
    Anne van Kesteren; et al. HTML Standard. Living Standard. URL: https://html.spec.whatwg.org/multipage/
    
    [INFRA]
@@ -4990,7 +4811,7 @@ 
    N
    
    [OIDC-Connect-Core]
    
    OIDC Connect Core. URL: https://openid.net/specs/openid-connect-core-1_0.html
    
    [PERMISSIONS-POLICY-1]
-   
    Ian Clelland. Permissions Policy. URL: https://w3c.github.io/webappsec-permissions-policy/
+   
    Ian Clelland. Permissions Policy. 24 July 2024. WD. URL: https://www.w3.org/TR/permissions-policy-1/
    
    [PRIVACY-THREAT-MODEL]
    
    Target Privacy Threat Model. URL: https://w3cping.github.io/privacy-threat-model/
    
    [RFC2119]
@@ -5000,13 +4821,13 @@ 
    N
    
    [RFC9110]
    
    R. Fielding, Ed.; M. Nottingham, Ed.; J. Reschke, Ed.. HTTP Semantics. June 2022. Internet Standard. URL: https://httpwg.org/specs/rfc9110.html
    
    [SECURE-CONTEXTS]
-   
    Mike West. Secure Contexts. URL: https://w3c.github.io/webappsec-secure-contexts/
+   
    Mike West. Secure Contexts. 10 November 2023. CR. URL: https://www.w3.org/TR/secure-contexts/
    
    [URL]
    
    Anne van Kesteren. URL Standard. Living Standard. URL: https://url.spec.whatwg.org/
    
    [WEBDRIVER1]
-   
    Simon Stewart; David Burns. WebDriver. URL: https://w3c.github.io/webdriver/
+   
    Simon Stewart; David Burns. WebDriver. 5 June 2018. REC. URL: https://www.w3.org/TR/webdriver1/
    
    [WebDriver2]
-   
    Simon Stewart; David Burns. WebDriver. URL: https://w3c.github.io/webdriver/
+   
    Simon Stewart; David Burns. WebDriver. 23 July 2024. WD. URL: https://www.w3.org/TR/webdriver2/
    
    [WEBIDL]
    
    Edgar Chen; Timothy Gu. Web IDL Standard. Living Standard. URL: https://webidl.spec.whatwg.org/
   
    
@@ -5041,7 +4862,7 @@ 
    I
 };
 
 [Exposed=Window, SecureContext]
-interface IdentityCredential : Credential {
+interface IdentityCredential : Credential {
   static Promise<undefined> disconnect(optional IdentityCredentialDisconnectOptions options = {});
   readonly attribute USVString? token;
   readonly attribute boolean isAutoSelected;
@@ -5051,7 +4872,7 @@ 
    I
   required USVString account_id;
 };
 
-partial dictionary CredentialRequestOptions {
+partial dictionary CredentialRequestOptions {
   IdentityCredentialRequestOptions identity;
 };
 
@@ -5175,54 +4996,6 @@ 
    getUserInfo() method. ↵
    • 
    
     Clarify the IDP API response when the user is not signed in. ↵
    
   
    • 
-  
    
-   ⚠MDN
-   
    
-    
    IdentityCredential/token
    
-    
    In only one current engine.
    
-    
    
-     FirefoxNoneSafariNoneChrome108+
-     
    
-     Opera?Edge108+
-     
    
-     Edge (Legacy)?IENone
-     
    
-     Firefox for Android?iOS Safari?Chrome for Android?Android WebView?Samsung Internet?Opera Mobile?
-    
    
-   
    
-  
    
-  
    
-   ⚠MDN
-   
    
-    
    IdentityCredential
    
-    
    In only one current engine.
    
-    
    
-     FirefoxNoneSafariNoneChrome108+
-     
    
-     Opera?Edge108+
-     
    
-     Edge (Legacy)?IENone
-     
    
-     Firefox for Android?iOS Safari?Chrome for Android?Android WebView?Samsung Internet?Opera Mobile?
-    
    
-   
    
-  
    
-  
    
-   ⚠MDN
-   
    
-    
    Headers/Permissions-Policy/identity-credentials-get
    
-    
    In only one current engine.
    
-    
    
-     FirefoxNoneSafariNoneChrome110+
-     
    
-     Opera?Edge110+
-     
    
-     Edge (Legacy)?IENone
-     
    
-     Firefox for Android?iOS Safari?Chrome for Android?Android WebView?Samsung Internet?Opera Mobile?
-    
    
-   
    
-  
    
 
 
-