demo · v142

Embed Allow Matrix

The deployment question this Chrome 142 UI change answers: when a top-level site embeds a third-party widget that needs sign-in, can the user tell who they're signing into? Below: a per-IDP allow/deny matrix that maps to Permissions-Policy: identity-credentials-get. Toggle a cell, see how the FedCM consent dialog Chrome 142 renders changes — and watch the iframe block its own call if the policy says no.

policy matrix — which embedded origins may invoke which IDPs

	idp.google	idp.github	idp.acme

https://shop.example ← top-level

Shop checkout. Sign-in widget is loaded in a third-party iframe.

iframe: comments.example

Please sign in to continue.

Pre-Chrome-142 the consent UI showed only "Continue to shop.example with idp.google" — users had no idea the comments iframe was the actual consumer. Chrome 142 lists the embedding iframe origin in the dialog, fixing a known phishing footgun.

relevant HTTP

# Top-level shop.example response
Permissions-Policy: identity-credentials-get=(self "https://comments.example")

# Iframe code
const cred = await navigator.credentials.get({
  identity: {
    providers: [
      { configURL: "https://idp.google/fedcm.json", clientId: "…" }
    ]
  }
});

relevant HTTP

see also