demo · v131

SSO iframe widget: SAA verdict simulator

The motivating case was an embedded SSO widget — a comment box from an identity provider, an embedded chat, an SDK login button — that needs first-party cookies inside a third-party iframe. With FedCM as a trust signal, the user's prior FedCM sign-in to the embed origin makes the Storage Access prompt auto-resolve.

requires fedcm enrollment The FedCM-as-SAA-trust-signal behaviour only kicks in when (a) the embed origin is a registered FedCM identity provider, (b) the user has a recent successful FedCM credential for that origin, and (c) the embedding page calls document.requestStorageAccess() from inside an iframe with the right permission policy. Pick the inputs below and see what the prompt model decides.

simulator

simulated embedded widget

the api

// inside the third-party iframe
const granted = await document.requestStorageAccess();
// pre-131: shows a permission prompt every time
// 131+:    auto-granted if user has a recent FedCM credential
//          for this iframe's origin (trust signal)

see also