Issues

• Unclear as to how the Fields API response is returned in current editors draft

  w3c-fedid/FedCM#846 · Filter by author ThisIsMissEm opened on Sep 22, 2026

• In the continue_on API, allow IdPs to control min/max width/height of the pop-up window

  w3c-fedid/FedCM#845 · Filter by author samuelgoto opened on Jul 30, 2026

• Add support for birthday to the list of recognized fields

  w3c-fedid/FedCM#844 · Filter by author samuelgoto opened on Jul 30, 2026

• Obtaining access tokens via FedCM

  w3c-fedid/FedCM#843 · Filter by author gffletch opened on Jul 28, 2026
  1

• CSP integration seems incorrect

  w3c-fedid/FedCM#838 · Filter by author annevk opened on Jul 16, 2026
  1

• credential.get() for both Passkey and FedCM in one call - what's the plan?

  w3c-fedid/FedCM#835 · Filter by author cgrushko opened on Jul 7, 2026
  4

• Remaining items to resolve in IDP Service Worker design

  w3c-fedid/FedCM#833 · Filter by author domfarolino opened on May 20, 2026
  36

• Clarify fallback vs failure behavior in sub-domain well-known discovery

  w3c-fedid/FedCM#832 · Filter by author pottis opened on May 19, 2026

• Standards compliance concerns raised by Dominic in Spec

  w3c-fedid/FedCM#829 · Filter by author pottis opened on May 9, 2026
  5

• FedCM facilitates vendor lock-in

  w3c-fedid/FedCM#827 · Filter by author will-bartlett opened on Apr 27, 2026
  25

• Support moving endpoints gradually

  w3c-fedid/FedCM#826 · Filter by author will-bartlett opened on Apr 23, 2026
  1

• DPoP for FedCM (natively)

  w3c-fedid/FedCM#820 · Filter by author ThisIsMissEm opened on Mar 24, 2026
  3

• Usability/UX/Accessability Research?

  w3c-fedid/FedCM#819 · Filter by author blaine opened on Mar 10, 2026
  4

• Cross-device/System-level FedCM Flows?

  w3c-fedid/FedCM#817 · Filter by author ThisIsMissEm opened on Mar 9, 2026
  12

• Discovery of Token Validation Metadata and Protocol Binding

  CR Blocker
  w3c-fedid/FedCM#810 · Filter by author oroka750 opened on Feb 4, 2026
  11

• Use of apex domain is hard for organizations with different services owning different subdomains

  CR Blocker
  w3c-fedid/FedCM#809 · Filter by author will-bartlett opened on Feb 2, 2026
  11

• Allow IdPs to initiate a FedCM flow in top level redirects without requiring changes to Relying Parties

  w3c-fedid/FedCM#794 · Filter by author samuelgoto opened on Nov 10, 2025
  1

• Incremental authentication/authorization

  w3c-fedid/FedCM#793 · Filter by author stianst opened on Oct 28, 2025
  1

• Lock subframes to same identity as parent frames

  w3c-fedid/FedCM#782 · Filter by author will-bartlett opened on Sep 4, 2025
  12

• Say something about caching

  w3c-fedid/FedCM#781 · Filter by author will-bartlett opened on Sep 4, 2025
  4

• Make it clear image fetches in the spec are uncredentialed

  w3c-fedid/FedCM#779 · Filter by author npm1 opened on Aug 29, 2025
  1

• Lack of generic params on login_url is limiting, unclear privacy value

  w3c-fedid/FedCM#778 · Filter by author will-bartlett opened on Aug 29, 2025
  9

• Manifest fingerprinting wording describes mitigation imprecisely

  w3c-fedid/FedCM#777 · Filter by author will-bartlett opened on Aug 29, 2025
  3

• Manifest fingerprinting via subdomains and public suffix list

  w3c-fedid/FedCM#776 · Filter by author will-bartlett opened on Aug 29, 2025
  4

• Extension to FedCM API to allow SAML or OIDC frontchannel logout

  w3c-fedid/FedCM#773 · Filter by author huebnd opened on Aug 12, 2025
  10