Description
The FedCM API allows websites to verify the identity of users via third party websites.
Rationale
Using third party websites for authentication is a common and legitimate way to perform user verification, but right now it requires a lot of hacks where cookies, redirects, and iframes are abused. Those same methods are also used for abusive/illegal tracking of users.
Support for the FedCM API would drastically improve the developer experience and user experience of building and using login flows. It would also allow browsers to tighten security around abusive trackers, since they would no longer have to leave intentional holes in the security that are required for login flows today.
I am proposing this as an investigation effort proposal because there are comments from Mozilla that they do not agree with the existing FedCM API, and they have created new specs that they think are more suited for broad adoption by browsers.
Signals to back up my claims:
Message of support in Webkit standards positions:
WebKit/standards-positions#309 (comment)
Message of support in Mozilla standards positions:
mozilla/standards-positions#618 (comment)
Developer signals feature with 41 likes:
web-platform-dx/developer-signals#208
Focus area proposal from 2026:
#1098
Investigation Roadmap
The purpose of this investigation effort would be for browser vendors to review the proposed changes and agree on a final specification for FedCM that could then be implemented later, maybe as an interop focus area in 2028.
Current specification:
https://w3c-fedid.github.io/FedCM/
Proposed alterations to specification:
https://github.com/fedidcg/LightweightFedCM
Current WPT tests:
https://wpt.fyi/results/fedcm
Description
The FedCM API allows websites to verify the identity of users via third party websites.
Rationale
Using third party websites for authentication is a common and legitimate way to perform user verification, but right now it requires a lot of hacks where cookies, redirects, and iframes are abused. Those same methods are also used for abusive/illegal tracking of users.
Support for the FedCM API would drastically improve the developer experience and user experience of building and using login flows. It would also allow browsers to tighten security around abusive trackers, since they would no longer have to leave intentional holes in the security that are required for login flows today.
I am proposing this as an investigation effort proposal because there are comments from Mozilla that they do not agree with the existing FedCM API, and they have created new specs that they think are more suited for broad adoption by browsers.
Signals to back up my claims:
Message of support in Webkit standards positions:
WebKit/standards-positions#309 (comment)
Message of support in Mozilla standards positions:
mozilla/standards-positions#618 (comment)
Developer signals feature with 41 likes:
web-platform-dx/developer-signals#208
Focus area proposal from 2026:
#1098
Investigation Roadmap
The purpose of this investigation effort would be for browser vendors to review the proposed changes and agree on a final specification for FedCM that could then be implemented later, maybe as an interop focus area in 2028.
Current specification:
https://w3c-fedid.github.io/FedCM/
Proposed alterations to specification:
https://github.com/fedidcg/LightweightFedCM
Current WPT tests:
https://wpt.fyi/results/fedcm