demo · v142

Third-party iframe origin in the FedCM UI

Edit the top-level site, the embedded iframe, and the identity provider — see the FedCM consent dialog before Chrome 142 (top frame only) next to the Chrome 142 dialog (the iframe origin shows too).

before · M141 and earlier

Chrome 142+

Static mockup of the browser-chrome FedCM dialog. The real prompt is rendered by Chrome itself when an iframe calls navigator.credentials.get({identity: …}).

relevant API

// Called from an iframe on comments-widget.io
// embedded inside news.example
navigator.credentials.get({
  identity: {
    providers: [{ configURL: "https://idp.example/.well-known/web-identity", clientId: "…" }],
  },
});
// Chrome 142+ shows BOTH "news.example" and "comments-widget.io" in the prompt.

see also