https://bytemastermind.github.io/tags/fedcm/Recent content in Fedcm on bytemastermind's blogHugoen-us© bytemastermindTue, 06 Oct 2026 00:00:00 +0000https://bytemastermind.github.io/posts/writeups/web/fedcm-xss-session-hijacking/Tue, 06 Oct 2026 00:00:00 +0000https://bytemastermind.github.io/posts/writeups/web/fedcm-xss-session-hijacking/<p>An XSS on a relying party using FedCM leads to session hijacking, even when its session cookies are HttpOnly. This is an already documented consequence of exposing login credentials to JavaScript, and something worth remembering when assessing XSS impact.</p> <p>Let&rsquo;s say <code>example.com</code> uses Google to sign users in through FedCM in Chrome. Here, <code>example.com</code> is the relying party (RP), and Google is the identity provider (IdP). The browser mediates the login, but ultimately returns a credential to the RP&rsquo;s JavaScript through <code>navigator.credentials.get()</code>. Its <code>token</code> property contains the login assertion. This handoff is shown in <a href="https://developer.chrome.com/docs/identity/fedcm/implement/relying-party">Chrome&rsquo;s RP implementation guide</a>.</p>