From f00f5854b342fec7049e0d204433e23449aeae06 Mon Sep 17 00:00:00 2001
From: Wendy Seltzer <wendy+gh@seltzer.org>
Date: Wed, 14 Aug 2024 15:43:08 +0000
Subject: [PATCH] Add list of FPWD critical issues (#623)

SHA: 22ec66de837b8770bb3465265e928f8b6b30207d
Reason: push, by wseltzer

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 43 ++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 40 insertions(+), 3 deletions(-)

diff --git a/index.html b/index.html
index 6abf74a4b..2982cef70 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <link href="https://www.w3.org/StyleSheets/TR/2021/cg-draft" rel="stylesheet">
   <meta content="Bikeshed version 82ce88815, updated Thu Sep 7 16:33:55 2023 -0700" name="generator">
   <link href="https://fedidcg.github.io/FedCM/" rel="canonical">
-  <meta content="10794f7327d3d44943b65c2013c4a7788b6c5cbe" name="document-revision">
+  <meta content="22ec66de837b8770bb3465265e928f8b6b30207d" name="document-revision">
 <style>
 dl.domintro dt {
     font-family: Menlo, Consolas, "DejaVu Sans Mono", Monaco, monospace;
@@ -917,7 +917,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1 class="p-name no-ref" id="title">Federated Credential Management API</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2024-05-15">15 May 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2024-08-14">14 August 2024</time></p>
    <div data-fill-with="spec-metadata">
     <dl>
      <dt>This version:
@@ -1039,6 +1039,7 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
      </ol>
     <li><a href="#extensibility"><span class="secno">8</span> <span class="content">Extensibility</span></a>
     <li><a href="#acknowledgements"><span class="secno">9</span> <span class="content">Acknowledgements</span></a>
+    <li><a href="#openissues"><span class="secno">10</span> <span class="content">FPWD Issues</span></a>
     <li>
      <a href="#w3c-conformance"><span class="secno"></span> <span class="content">Conformance</span></a>
      <ol class="toc">
@@ -4518,6 +4519,42 @@ <h2 class="heading settled" data-level="8" id="extensibility"><span class="secno
    <p class="note" role="note"><span class="marker">Note:</span> go over the extensibility mechanisms.</p>
    <h2 class="heading settled" data-level="9" id="acknowledgements"><span class="secno">9. </span><span class="content">Acknowledgements</span><a class="self-link" href="#acknowledgements"></a></h2>
    <p class="note" role="note"><span class="marker">Note:</span> write down the Acknowledgements section.</p>
+   <h2 class="heading settled" data-level="10" id="openissues"><span class="secno">10. </span><span class="content">FPWD Issues</span><a class="self-link" href="#openissues"></a></h2>
+    Note: The WG has labeled the following issues as critical open issues that must be formally addressed before publication of a Candidate Recommendation. 
+   <ul id="issueList">
+    <ul>
+     <li>Issue 240: <a href="https://github.com/fedidcg/FedCM/issues/240">Users can’t use IdPs outside of the ones enumerated by RPs</a>
+     <li>Issue 317: <a href="https://github.com/fedidcg/FedCM/issues/317">concerns about email in Accounts List</a>
+     <li>Issue 319: <a href="https://github.com/fedidcg/FedCM/issues/319">Allow multiple IDPs to be used</a>
+     <li>Issue 320: <a href="https://github.com/fedidcg/FedCM/issues/320">Why Sec-FedCM-CSRF and not Sec-Fetch-Mode</a>
+     <li>Issue 352: <a href="https://github.com/fedidcg/FedCM/issues/352">Share performance measurement with IDP</a>
+     <li>Issue 407: <a href="https://github.com/fedidcg/FedCM/issues/407">[Context API] - Authz / relation to ability to specificy scope</a>
+     <li>Issue 428: <a href="https://github.com/fedidcg/FedCM/issues/428">Enforce CORS on the Identity Assertions endpoint</a>
+     <li>Issue 441: <a href="https://github.com/fedidcg/FedCM/issues/441">The IDP has to support additional infrastructure to support FedCM</a>
+     <li>Issue 442: <a href="https://github.com/fedidcg/FedCM/issues/442">A not-yet logged in IDP has no route to success with this flow</a>
+     <li>Issue 467: <a href="https://github.com/fedidcg/FedCM/issues/467">Use cases for Cross-Site Cookie Access through Storage Access API after FedCM grant?</a>
+     <li>Issue 488: <a href="https://github.com/fedidcg/FedCM/issues/488">Users may be confused after showing intent to sign in but the sign-in is failed</a>
+     <li>Issue 511: <a href="https://github.com/fedidcg/FedCM/issues/511">Allow signing in to additional account(s)</a>
+     <li>Issue 517: <a href="https://github.com/fedidcg/FedCM/issues/517">Allow user agents to use "Connected Accounts Set" with flexibility</a>
+     <li>Issue 537: <a href="https://github.com/fedidcg/FedCM/issues/537">Allow setting IDP login status from same-site subresources</a>
+     <li>Issue 552: <a href="https://github.com/fedidcg/FedCM/issues/552">Allow IDPs to use multiple config files within an eTLD+1</a>
+     <li>Issue 553: <a href="https://github.com/fedidcg/FedCM/issues/553">Allowing IDPs to expose different account lists in different contexts</a>
+     <li>Issue 555: <a href="https://github.com/fedidcg/FedCM/issues/555">Allow IdPs to continue and finish the request in a popup window</a>
+     <li>Issue 556: <a href="https://github.com/fedidcg/FedCM/issues/556">Passing arbitrary parameters to the ID assertion endpoint</a>
+     <li>Issue 559: <a href="https://github.com/fedidcg/FedCM/issues/559">Allow RPs to selectively request attributes of the user’s profile</a>
+     <li>Issue 578: <a href="https://github.com/fedidcg/FedCM/issues/578">Allow IdPs to return JSON objects rather than Strings back to RPs</a>
+     <li>Issue 585: <a href="https://github.com/fedidcg/FedCM/issues/585">Allow IdP registration and RPs to match on a "type"</a>
+     <li>Issue 587: <a href="https://github.com/fedidcg/FedCM/issues/587">Why must SameSite=none?</a>
+     <li>Issue 599: <a href="https://github.com/fedidcg/FedCM/issues/599">OAuth profile for FedCM</a>
+     <li>Issue 609: <a href="https://github.com/fedidcg/FedCM/issues/609">Spec says we send SameSite=Strict cookies</a>
+     <li>Issue 616: <a href="https://github.com/fedidcg/FedCM/issues/616">Once <code>params</code> are merged into the spec, deprecate the <code>nonce</code> parameter</a>
+     <li>Issue 618: <a href="https://github.com/fedidcg/FedCM/issues/618">Support chained authentication flows before reducing heuristics and classifications/lists in navigational tracking mitigations</a>
+     <li>Issue 620: <a href="https://github.com/fedidcg/FedCM/issues/620">Make it easier to deploy this at the eTLD+1 for registered IdPs</a>
+     <li>Issue 625: <a href="https://github.com/fedidcg/FedCM/issues/625">Returning accounts go first in getUserInfo</a>
+     <li>Issue 626: <a href="https://github.com/fedidcg/FedCM/issues/626">PP/TOS requirements are different from auto reauthentication</a>
+     <li>Issue 627: <a href="https://github.com/fedidcg/FedCM/issues/627">Add webdriver command to open PP/TOS</a>
+    </ul>
+   </ul>
   </main>
   <div data-fill-with="conformance">
    <h2 class="no-ref no-num heading settled" id="w3c-conformance"><span class="content">Conformance</span><a class="self-link" href="#w3c-conformance"></a></h2>
@@ -4925,7 +4962,7 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dt id="biblio-clear-site-data">[CLEAR-SITE-DATA]
    <dd>Mike West. <a href="https://w3c.github.io/webappsec-clear-site-data/"><cite>Clear Site Data</cite></a>. URL: <a href="https://w3c.github.io/webappsec-clear-site-data/">https://w3c.github.io/webappsec-clear-site-data/</a>
    <dt id="biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]
-   <dd>Nina Satragno. <a href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management Level 1</cite></a>. URL: <a href="https://w3c.github.io/webappsec-credential-management/">https://w3c.github.io/webappsec-credential-management/</a>
+   <dd>Nina Satragno; Marcos Caceres. <a href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management Level 1</cite></a>. URL: <a href="https://w3c.github.io/webappsec-credential-management/">https://w3c.github.io/webappsec-credential-management/</a>
    <dt id="biblio-csp">[CSP]
    <dd>Mike West; Antonio Sartori. <a href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a>. URL: <a href="https://w3c.github.io/webappsec-csp/">https://w3c.github.io/webappsec-csp/</a>
    <dt id="biblio-css-color-4">[CSS-COLOR-4]