category
Identity & Auth
Passkeys, WebAuthn, FedCM, Digital Credentials, autofill, payment confirmation, sign-in flows.
43 of 48 demos built, across 22 releases.
Chrome 156 (1)
-
Web Install API
Triggers a request for the browser to install a web app, given a manifest URL and optional manifest ID. The navigator.install() method enables cross-origin web app installation and provides a better developer experience ...
Chrome 155 (1)
-
Digital Credentials API (issuance support)
This Web Platform feature enables issuing websites (e.g., a university, government agency, or bank) to securely initiate the provisioning (issuance) process of digital credentials directly into a user's mobile wallet app...
Chrome 154 (1)
-
Secure Payment Confirmation: Locale Validation
Updates Secure Payment Confirmation's `locale` data field to return a Not Supported DOMException if none of the language tags provided in the field match the language used by the Secure Payment Confirmation's dialog. If ...
Chrome 153 (2)
-
Deprecate and Remove: document.requestStorageAccessFor
The requestStorageAccessFor (rSAFor) API is an extension to the Storage Access API that allows a top-level site to request access to unpartitioned ("first-party") cookies on behalf of embedded sites. Browsers will have d...
-
Deprecate and Remove: Related Website Sets (RWS)
Related Website Sets (RWS), formerly known as First Party Sets, provides a framework for developers to declare relationships among sites, to enable limited cross-site cookie access for specific, user-facing purposes. Thi...
Chrome 151 (1)
-
More specific protocol filtering in Digital Credential API
Chrome 151 began deprecating support for unspecified presentation and issuance protocols in the **Digital Credentials API**; final removal is scheduled for Chrome 160. The Digital Credentials API was originally designed...
Chrome 150 (1)
-
Email Verification Protocol
The EVP (email verification protocol) helps users create, access and recover accounts by providing cryptographic proof of ownership seamlessly rather than email OTPs manually.
Chrome 148 (1)
-
Get Secure Payment Confirmation Capabilities
Adds a new static method to the Payment Request that allows web developers to get the capabilities of the browser's implementation of Secure Payment Confirmation. This helps web developers to easily know what capabiliti...
Chrome 147 (2)
-
Autofill event
Autofill is a key feature of the web that reduces friction for millions of users everyday. But getting autofill to work reliably with dynamic forms across multiple implementations requires jumping through many hoops. Th...
-
Device Bound Session Credentials
To enhance user security and combat session cookie theft, Chrome is introducing [Device Bound Session Credentials (DBSC)](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials). This feature all...
Chrome 145 (3)
-
Device Bound Session Credentials
To enhance user security and combat session cookie theft, Chrome is introducing [Device Bound Session Credentials (DBSC)](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials). This feature all...
-
Secure Payment Confirmation: Browser Bound Keys
Adds an additional cryptographic signature over Secure Payment Confirmation assertions and credential creation. The corresponding private key is not synced across devices. This helps web developers meet requirements for ...
-
Secure Payment Confirmation: UX Refresh
Updates the UX elements for the SPC dialog on Android Chrome. Other than just UX presentation the following are being added: - Allowing merchants to provide an optional list of payment entity logos related to the paymen...
Chrome 144 (2)
-
Deprecate and Remove: document.requestStorageAccessFor
The requestStorageAccessFor (rSAFor) API is an extension to the Storage Access API that allows a top-level site to request access to unpartitioned ("first-party") cookies on behalf of embedded sites. Browsers will have d...
-
Deprecate and Remove: Related Website Sets (RWS)
Related Website Sets (RWS), formerly known as First Party Sets, provides a framework for developers to declare relationships among sites, to enable limited cross-site cookie access for specific, user-facing purposes. Thi...
Chrome 143 (5)
-
Digital Credentials API (issuance support)
This Web Platform feature enables issuing websites (e.g., a university, government agency, or bank) to securely initiate the provisioning (issuance) process of digital credentials directly into a user's mobile wallet app...
-
FedCM Privacy Enforcement for Client Metadata
To address cross-site identity correlation risks in the FedCM API, Identity Providers (IdPs) that utilize client_metadata within their FedCM configuration are required to implement the direct endpoints format in the .wel...
-
FedCM-Migration of nonce to params field & Renaming of IdentityCredentialError code attribute to error
Migration of nonce to params Field: The nonce parameter in navigator.credentials.get() is moving from a top-level field to the params object for better API design, extensibility, and maintainability. This structured appr...
-
FedCM—Support Structured JSON Responses from IdPs
Allows Identity Providers (IdPs) to return structured JSON objects instead of plain strings to Relying Parties (RPs) via the id_assertion_endpoint. This change simplifies integration for developers by eliminating the ...
-
Web Install API
Triggers a request for the browser to install a web app, given a manifest URL and optional manifest ID. The navigator.install() method enables cross-origin web app installation and provides a better developer experience ...
Chrome 142 (2)
-
Device Bound Session Credentials
To enhance user security and combat session cookie theft, Chrome is introducing [Device Bound Session Credentials (DBSC)](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials). This feature all...
-
FedCM—Support showing third-party iframe origins in the UI
Currently, FedCM always shows the toplevel site in its UI. This works well when the iframe is conceptually first-party (e.g. foo.com may have an iframe foostatic.com, which is not meaningful to the user). But if th...
Chrome 141 (3)
-
Digital Credentials API (presentation support)
Websites can and do get credentials from mobile wallet apps through a variety of mechanisms today (custom URL handlers, QR code scanning, etc.). This Web Platform feature would allow sites to request identity informatio...
-
FedCM: Alternative Fields in Account Selection
Adds support for phone numbers and usernames, in addition to or instead of a user's full name and email address as identifiers for disambiguating accounts in the account selector. Also, makes these new fields available f...
-
Strict Same Origin Policy for Storage Access API
In Chrome 141, Storage Access API semantics now strictly follow the Same Origin policy, to enhance security. Using `document.requestStorageAccess()` in a frame only attaches cookies to requests to the iframe's origin (...
Chrome 139 (2)
-
Secure Payment Confirmation: UX Refresh
Updates the UX elements for the SPC dialog on Android Chrome. Other than just UX presentation the following are being added: - Allowing merchants to provide an optional list of payment entity logos related to the paymen...
-
Web Install API
Triggers a request for the browser to install a web app, given a manifest URL and optional manifest ID. The navigator.install() method enables cross-origin web app installation and provides a better developer experience ...
Chrome 137 (1)
-
Align error type thrown for 'payment' WebAuthn credential creation: SecurityError => NotAllowedError
Correct the error type thrown during WebAuthn credential creation for 'payment' credentials. Due to a historic specification mismatch, creating a 'payment' credential in a cross-origin iframe without a user activation wo...
Chrome 136 (3)
-
FedCM multi IDP in single get() call and remove add accounts in passive mode
Allows FedCM to show multiple identity providers in the same dialog. This provides developers with a convenient way to present all supported identity providers to users. We are planning to first tackle the simple case of...
-
FedCM: Alternative Fields in Account Selection
Adds support for phone numbers and usernames, in addition to or instead of a user's full name and email address as identifiers for disambiguating accounts in the account selector. Also, makes these new fields available f...
-
Web Authentication Conditional Create (Automatic Passkey Upgrades)
WebAuthn Conditional Create allows websites to automatically create passkeys for existing users that have a matching password saved in their password manager.
Chrome 135 (4)
-
Align error type thrown for 'payment' WebAuthn credential creation: SecurityError => NotAllowedError
Correct the error type thrown during WebAuthn credential creation for 'payment' credentials. Due to a historic specification mismatch, creating a 'payment' credential in a cross-origin iframe without a user activation wo...
-
Device Bound Session Credentials
To enhance user security and combat session cookie theft, Chrome is introducing [Device Bound Session Credentials (DBSC)](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials). This feature all...
-
Link rel=facilitated-payment to support push payments
Adds support for <link rel="facilitated-payment" href="..."> as a hint that the browser should notify registered payment clients about a pending push payment.
-
Secure Payment Confirmation: Browser Bound Keys
Adds an additional cryptographic signature over Secure Payment Confirmation assertions and credential creation. The corresponding private key is not synced across devices. This helps web developers meet requirements for ...
Chrome 134 (2)
-
Digital Credentials API (presentation support)
Websites can and do get credentials from mobile wallet apps through a variety of mechanisms today (custom URL handlers, QR code scanning, etc.). This Web Platform feature would allow sites to request identity informatio...
-
Link rel=facilitated-payment to support push payments
Adds support for <link rel="facilitated-payment" href="..."> as a hint that the browser should notify registered payment clients about a pending push payment.
Chrome 133 (4)
-
Digital Credentials API (issuance support)
This Web Platform feature enables issuing websites (e.g., a university, government agency, or bank) to securely initiate the provisioning (issuance) process of digital credentials directly into a user's mobile wallet app...
-
Digital Credentials API (presentation support)
Websites can and do get credentials from mobile wallet apps through a variety of mechanisms today (custom URL handlers, QR code scanning, etc.). This Web Platform feature would allow sites to request identity informatio...
-
Storage Access Headers
Offers an alternate way for authenticated embeds to opt in for unpartitioned cookies. These headers indicate whether unpartitioned cookies are (or can be) included in a given network request, and allow servers to activat...
-
Web Authentication API: PublicKeyCredential’s getClientCapabilities() method
getClientCapabilities() method allows to determine which WebAuthn features are supported by the user's client. The method returns a list of supported capabilities, allowing developers to tailor authentication experiences...
Chrome 132 (3)
-
FedCM Mode API (f.k.a. button mode) and Use Other Account API
We intend to ship two new extensions for FedCM to address two issue that were collectively identified as CR blockers by the FedID WG: “A not-yet logged in IDP has no route to success” and “Allow signing in to additional ...
-
FedCM authorization features (fka bundle 6: Continuation API, Parameters API, Fields API, Multiple configURLs, Custom account labels)
This bundles a few features that we would like to launch at the same time. We are bundling them together because they can be used by IdPs to implement authorization flows such as letting a user grant access to a user’s c...
-
WebAuthn signal API
Allow WebAuthn relying parties to report information about existing credentials back to credential storage providers, so that incorrect or revoked credentials can be updated or removed from provider and system UI. htt...
Chrome 131 (2)
-
FedCM as a trust signal for the Storage Access API
Reconciles the FedCM and Storage Access APIs by making a prior FedCM grant a valid reason to automatically approve a storage access request. When a user grants permission for using their identity with a 3rd party Identi...
-
Web Authentication API: PublicKeyCredential’s getClientCapabilities() method
getClientCapabilities() method allows to determine which WebAuthn features are supported by the user's client. The method returns a list of supported capabilities, allowing developers to tailor authentication experiences...
Chrome 130 (2)
-
Storage Access Headers
Offers an alternate way for authenticated embeds to opt in for unpartitioned cookies. These headers indicate whether unpartitioned cookies are (or can be) included in a given network request, and allow servers to activat...
-
WebAuthn signal API
Allow WebAuthn relying parties to report information about existing credentials back to credential storage providers, so that incorrect or revoked credentials can be updated or removed from provider and system UI. htt...