demo · v143
String vs JSON
The motivating contrast: a pre-v143 IdP response was a plain string (the JWT). Now the IdP can return a structured JSON object directly. Side-by-side: see what the RP has to write in each case.
IdP response shape:
1. id_assertion_endpoint payload
2. what the browser hands to the RP
3. what the RP has to write
the contrast
// LEGACY: id_assertion_endpoint returns { "token": "eyJ..." }
// RP has to JWT-decode and JSON.parse claims:
const cred = await navigator.credentials.get({ identity: {...} });
const claims = JSON.parse(atob(cred.token.split(".")[1]));
const email = claims.email;
// V143: id_assertion_endpoint can return structured JSON directly
// { "token": { "email": "user@idp", "name": "Alice", "groups": ["admin"] } }
const cred = await navigator.credentials.get({ identity: {...} });
const { email, name, groups } = cred.token; // already an object
why this angle
The other concept renders a mock account chooser. This one focuses on the RP integration cost — the asymmetry between "JWT string, decode it yourself" and "structured JSON, use it directly". That's the actual reason this feature was added.