v143 · miscellaneous

FedCM Privacy Enforcement for Client Metadata

To address cross-site identity correlation risks in the FedCM API, Identity Providers (IdPs) that utilize client_metadata within their FedCM configuration are required to implement the direct endpoints format in the .well-known/web-identity file. This mandate ensures that both accounts_endpoint and login_url are explicitly defined whenever a client_metadata_

concepts

  1. Metadata Fetch

    Wire-level simulator: toggle the endpoints in .well-known/web-identity and compare the pre-v143 fetch with the v143 sanitised one. Tells you whether v143 will accept the IdP config.

  2. Config validator

    Paste a .well-known/web-identity JSON and the page applies Chrome 143's new privacy rule — the exact check IdP operators need before shipping.

  3. Privacy leak explorer

    Walk through the cross-site correlation risk this change closes. Pick a configuration (indirect, direct, missing-meta, mismatched) and watch each step pass or fail, with the verdict explained.

  4. Metadata Audit Tool

    Five JSON presets (minimal, well-configured, over-sharing, insecure HTTP, leaky user fields). Audit checks include HTTPS on all URLs, provider_urls validity, non-spec extra fields, and user-identifying fields at config level. A live privacy risk score meter (0–100) fills with colour, and a checklist with pass/warn/fail items provides per-item remediation text.

why it shipped

To address cross-site identity correlation risks in the FedCM API, Identity Providers (IdPs) that utilize client_metadata within their FedCM configuration are required to implement the direct endpoints format in the .well-known/web-identity file. This mandate ensures that both accounts_endpoint and login_url are explicitly defined whenever a client_metadata_

references