Web Authenticator API: cross-origin iframe support

Adds support for web authentication calls from cross-origin iframes if enabled by a feature policy. This brings Chrome in line with the Web Authentication level two specification (https://w3c.github.io/webauthn/#sctn-iframe-guidance).

There are two use cases that the working group is aware of: Firstly, there is interest in banks using this to comply with PSD2 regulations in the EU where they have to authenticate their users inside the context of a 3rd-party service-provider's site. Secondly, some sites wish to outsource their authentication to 3rd-party providers.



Editor's draft

Status in Chromium


In development (tracking bug)

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.

  • Public support
  • No public signals
  • No public signals
  • No signals


Last updated on 2019-08-15