Is effectiveQueryURL necessary?

[samuelgoto]

Can't IdPs enforce valid RPs post account selection? What happens if an IdP changes their mind about which RPs to allow after the navigator.credentials.store() (e.g. from an abuse system made asynchronously a determination that an RP is abusive)? Isn't that typically a decision that is made on the server side? Have we heard from any IdPs that can actually use this in production in a real deployment scenario?

[ekovac]

It does feel that way, now that the token is not provided at store-time. When there was a possibility there was something sensitive in there, we definitely needed that control. Now that that's being retrieved using something compatible with the Identity Assertion endpoint (which has the Origin in the headers etc) this shouldn't be necessary.

That is to say, +1 to this (and ditto for effectiveOrigins, probably?)

[johannhof]

I think the concern we're trying to mitigate here is the "reputation attack" where an IdP might want to prevent its prompt being shown on unreputable / illegal sites to avoid the impression of endorsement.

Would be interested in @bvandersloot-mozilla's thoughts.

[ekovac]

This starts to come back around to "Is Lightweight FedCM for all IdPs or is Lightweight FedCM for small IdPs," I think.

[bvandersloot-mozilla]

I think the concern we're trying to mitigate here is the "reputation attack" where an IdP might want to prevent its prompt being shown on unreputable / illegal sites to avoid the impression of endorsement.

Precisely. And many IdPs, not just large ones, can't disclose their RP lists, so they require a dynamic fetch.

[bvandersloot-mozilla]

This starts to come back around to "Is Lightweight FedCM for all IdPs or is Lightweight FedCM for small IdPs," I think.

My position is that it should work for all IdPs.

[samuelgoto]

And many IdPs, not just large ones, can't disclose their RP lists, so they require a dynamic fetch.

If it requires a dynamic fetch, maybe it belongs into the client_metadata_endpoint rather than navigator.credentials.store()?