v132 · miscellaneous

FedCM Mode API (f.k.a. button mode) and Use Other Account API

We intend to ship two new extensions for FedCM to address two issue that were collectively identified as CR blockers by the FedID WG: “A not-yet logged in IDP has no route to success” and “Allow signing in to additional account(s)”.

concepts

  1. FedCM Mode + Use Other

    FedCM gains an explicit mode (widget vs button) and a Use Other Account flow. Sites can place a real account-picker button instead of relying on widget auto-show.

  2. use other account

    Adding a second identity at the same IdP — the browser-managed login popup flow, end to end.

  3. mode state flow

    Six combinations of (mode, IDP-login-state). Walk the flow step-by-step and see which prompt, which network calls, which resolution each combination produces.

  4. dialog wireframes

    Side-by-side wireframes of passive vs active mode UIs across four scenarios — one account, multiple, with use-other-account, signed-out.

why it shipped

The web needs a long term solution for federated login, as browsers handle tracking on the web. While heuristics [1] can buy us some time in the short term, these two proposals extend FedCM to put us a couple steps closer to being able to operate federated login without them. The first extension handles an “active” mode (as opposed to / in addition to the current “passive” mode), where the browser needs to handle more gracefully when users are logged out of IdPs (take the user to login to the IdP, as opposed to failing silently), as Mozilla pointed out here [2]. The second extension allows use

references