demo · v142 · miscellaneous

Origin Disclosure Builder

Configure exactly how FedCM discloses origins in its browser dialog. Watch the mock chooser update live as you toggle settings — and see the risk score climb when an iframe origin is hidden from the user.

Configuration

Browser dialog preview

Chrome — Sign in chooser
Sign in to continue
Sign in with ExampleIDP

Risk score

0 / 100
LowHigh
Both origins shown — user has full context.

Code snippet

The navigator.credentials.get() call below is what an embedded IDP iframe issues. The origin visibility is controlled by the browser based on the embedding relationship.

// Inside an iframe at https://login.idp.example
// The page at https://shop.example.com embeds this iframe

const credential = await navigator.credentials.get({
  identity: {
    providers: [{
      configURL: "https://login.idp.example/fedcm.json",
      clientId: "client-shop-1234",
    }],
    context: "signin",   // "signin" | "signup" | "use" | "continue"
  },
});
// Chrome 142: browser dialog shows BOTH origins:
//   "shop.example.com" (top-level)
//   "embedded by login.idp.example" (iframe)
// Pre-142: only the configURL origin was shown

See also