Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The Registration API: Remove the user gesture requirement behind IdentityProvider.register() #7

Open
samuelgoto opened this issue May 21, 2024 · 7 comments

Comments

@samuelgoto
Copy link
Collaborator

Came up in the FedID CG call in a discussion @aaronpk.

@cbiesinger brought this up in the past, so FYI.

I don't think it is strictly necessary, as far as privacy and security is concerned, but it is also not clear to me how an IdP would provide a user experience without an explicit user action.

Anyway, seems like a valid feature request, so tracking it here.

@samuelgoto
Copy link
Collaborator Author

@npm1 says he is working on it! That was fast! :)

@cbiesinger
Copy link

FWIW, the reason I had previously brought it up was that I was thinking IdPs may want to register as soon as the user logs in successfully

@aaronpk
Copy link

aaronpk commented May 21, 2024

I do think some/many IdPs would want to call register as soon as the user logs in, but I'm not actually sure that is the best idea. I can definitely see that getting abused by websites that aren't "actually" IdPs for example.

I don't think it's bad to require a user gesture first. Browser popups like the location and notification permission are already pretty noisy when you go to random websites, I'd hate to see this one get added to the noise too.

@samuelgoto
Copy link
Collaborator Author

Browser popups like the location and notification permission are already pretty noisy when you go to random websites, I'd hate to see this one get added to the noise too.

Yeah, that was my intention having it be behind a user gesture: abuse and permission blindness. Glad some of that matches your intuition too.

@npm1
Copy link

npm1 commented May 21, 2024

@npm1 says he is working on it! That was fast! :)

For the record, I was not talking about this issue 😆

@obfuscoder
Copy link

Is this user interaction/gesture also required for registering an IdP via the response header? One scenario I can think of right away is that an IdP would like to silently register while performing a SSO via OpenIdConnect/OAuth redirect flow which does not need an interaction if there is already a signed-in state.

@obfuscoder
Copy link

Oh wait, there is no FedCM IdP registration via response header. I mixed that one up with login status.

@samuelgoto samuelgoto changed the title Remove the user gesture requirement behind IdentityProvider.register() The Registration API: Remove the user gesture requirement behind IdentityProvider.register() May 21, 2024
@samuelgoto samuelgoto transferred this issue from w3c-fedid/FedCM Sep 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants