demo · v143

Metadata Fetch

Pick an IdP config shape and toggle which endpoints are declared in .well-known/web-identity. The simulator shows the pre-v143 fetch (with cookies and clientId) vs the v143 sanitised fetch, and tells you whether v143 would allow the flow at all.

configuration

request before v143


      

      

        
request in v143

        

      

    


    
Real verification needs an actual IdP endpoint. This is a client-side model of what Chrome 143 puts on the wire.

  


  

    
the contract


# .well-known/web-identity on the IdP
{
  "provider_urls": ["https://idp.example/fedcm.json"],
  "accounts_endpoint": "/fedcm/accounts",      # required in v143
  "login_url": "/login",                        # required in v143
  "client_metadata_endpoint": "/fedcm/metadata"
}

# Chrome 143 metadata fetch:
GET /fedcm/metadata
Sec-Fetch-Dest: webidentity
# NO cookies, NO clientId in URL or body

  


  

    
see also