demo · v143
FedCM Client Metadata Audit Tool
Paste your IdP's .well-known/web-identity config JSON and run an automated audit. Checks HTTPS URLs, CORS headers, spec-minimum fields, and privacy risk — with a live risk score and Chrome 143 enforcement comparison.
IdP configuration JSON
Paste your /.well-known/web-identity JSON, or start with one of the presets below.
Privacy risk score
0
0 = no risk 100 = critical
Audit checklist
Chrome 143 enforcement: before vs after
Chrome 143 tightens what it allows when fetching client metadata. Here is what changes based on your configuration.
Before Chrome 143 (pre-enforcement)
After Chrome 143 (enforced)
What Chrome 143 enforces
- CORS required — the
client_metadata_endpointmust includeAccess-Control-Allow-Originheaders. Requests without a valid CORS response are blocked. - HTTPS only — policy, terms-of-service, and client metadata URLs must use HTTPS. HTTP URLs in these fields are rejected.
- Minimal data — Chrome limits what fields the metadata endpoint can return and how they can be used, reducing the IdP's ability to track the RP across requests.
- No user-identifying fields at config level — fields like
email,phone, anduser_idmust only appear per-request, not in the static config.