Cross-origin iframe support and FedCM without 3p cookies

[FedCM developer newsletter]

Hi, FedCM newsletter subscribers! We have two updates to the API:

1. Chrome shipped cross-origin iframe support for FedCM in version 110 (stable release on Feb 7, 2023). The embedder should specify the Permissions-Policy identity-credentials-get to allow FedCM API in the embedded cross-origin iframe. You can check out an example of the cross-origin iframe.

2. You can block third-party cookies in Chrome by following the instructions in the FedCM API documentation. However, FedCM is temporarily disabled if third-party cookies are blocked. To help developers test whether their websites are affected by Chrome phasing out third-party cookies and check how FedCM can help with fixing the breakage, Chrome added a new flag #fedcm-without-third-party-cookies in version 110. By enabling the flag, you can test FedCM with third-party cookies blocked.

Should you have any feedback on the API, please file them at https://new.crbug.com and set Components to Blink>Identity>FedCM.

Thank you!