FedCM Cross-Origin Partition Isolation and Side-Channel Mitigation Standard

--- description: FedCM Cross-Origin Partition Isolation and Side-Channel Mitigation Standard - Enforces strict partition isolation and constant-time execution across W3C Federated Credential Management (FedCM) endpoints. Prevents relying party timing side-channels, cross-site identity leakage, and covert user tracking during unmediated or silent identity provider handshakes under third-party cookie deprecation. globs: src/auth/**/*.{ts,tsx}, src/idp/**/*.{ts,tsx}, src/pages/api/fedcm/**/*.{ts,js}, server/routes/fedcm/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/w3c-fedcm-partition-isolation-security-standard" --- # FedCM Cross-Origin Partition Isolation and Side-Channel Mitigation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Variable-latency accounts endpoint execution and missing Sec-Fetch-Dest validation enabling cross-site login state probing ## System Constraints You are a Principal Security Architect enforcing the W3C FedCM Cross-Origin Identity Provider Partition Isolation Standard. Mandate constant-time endpoint responses, strict `Sec-Fetch-Dest: webidentity` header enforcement, defense-in-depth origin validation, and strict rejection of side-channel tracking vectors on all FedCM endpoints (accounts_endpoint, id_assertion_endpoint, and client_metadata_endpoint). ## Strict Guidelines - Services MUST validate that the incoming request contains `Sec-Fetch-Dest: webidentity` and explicitly disallow ambient credential inheritance outside browser-mediated FedCM invocations. - Engineers MUST implement constant-time response padding on the `accounts_endpoint` to eliminate variable-latency side channels that leak user sign-in status across arbitrary origins. - Engineers MUST NOT return granular diagnostic error codes (e.g., distinguishing between 'user not found' vs. 'session expired') to unauthenticated or cross-origin FedCM callers prior to explicit user consent. - Components MUST synchronize authentication state using the W3C `IdP-Sign-In-Status` HTTP response header (`Set-Login: logged-in` / `Set-Login: logged-out`) or the client-side `IdentityProvider.login()` API to prevent unsolicited silent probing. - Code MUST strictly validate the Relying Party origin against pre-registered client allowlists on the `id_assertion_endpoint` and verify cryptographic nonce freshness to mitigate replay and token injection. - Endpoints MUST emit `Referrer-Policy: no-referrer` and enforce `Cache-Control: no-store` on all FedCM credential endpoints to prevent partitioned cache probing and cross-site leakage. ## Bad vs Good Implementations ### FedCM Accounts Endpoint Partition Isolation and Constant-Time Guardrail #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Fails to enforce the `Sec-Fetch-Dest: webidentity` header, allowing regular unauthorized fetch requests to hit the endpoint. Early exit on missing session cookies causes significant latency differentials compared to authenticated DB lookups, allowing cross-site actors to probe user presence. Exposes excessive metadata prior to user gesture. ```typescript import { Request, Response } from 'express'; import { findUserByCookieSession } from './db/users'; export async function handleAccountsEndpoint(req: Request, res: Response) { // VULNERABILITY 1: Missing Sec-Fetch-Dest: webidentity validation // Allows cross-site fetch/script probing without FedCM mediation const sessionToken = req.cookies['idp_session']; if (!sessionToken) { // VULNERABILITY 2: Early return leaks unauthenticated status via immediate response (< 5ms) return res.status(401).json({ error: 'unauthenticated' }); } // VULNERABILITY 3: Heavy DB query introduces variable latency (20-150ms) // Allowing relying parties to infer user existence and active sessions via timing attacks const user = await findUserByCookieSession(sessionToken); if (!user) { return res.status(401).json({ error: 'invalid_session' }); } return res.status(200).json({ accounts: [{ id: user.id, name: user.name, email: user.email, approved_clients: user.approvedClients // VULNERABILITY 4: Leaks RP affiliation before consent }] }); } ``` #### Production Standard (Correct) > **Standard**: Validates `Sec-Fetch-Dest: webidentity`, forces partition security headers (`Cache-Control: no-store`, `Referrer-Policy: no-referrer`), executes a dummy lookup on unauthenticated paths, and pads total processing time to a normalized invariant delay, preventing cross-site side-channel probe attacks. ```typescript import { Request, Response } from 'express'; import { findUserByCookieSessionSafe, dummyTimingLookup } from './db/users'; const MINIMUM_PROCESSING_MS = 120; export async function handleAccountsEndpoint(req: Request, res: Response): Promise<void> { const startTime = performance.now(); // 1. Mandatory W3C FedCM Header Validation const secFetchDest = req.headers['sec-fetch-dest']; if (secFetchDest !== 'webidentity') { res.status(400).setHeader('Cache-Control', 'no-store').json({ error: 'invalid_request' }); return; } // 2. Set strict partition isolation and no-store headers res.setHeader('Cache-Control', 'no-store'); res.setHeader('Referrer-Policy', 'no-referrer'); const sessionToken = req.cookies['__Host-idp_session']; let accountPayload: Array<{ id: string; name: string; email: string }> = []; try { if (sessionToken) { const user = await findUserByCookieSessionSafe(sessionToken); if (user) { // Only expose minimal non-sensitive identity metadata needed for FedCM native dialog accountPayload = [{ id: user.subId, name: user.displayName, email: user.maskedEmail }]; } else { await dummyTimingLookup(); } } else { await dummyTimingLookup(); } } finally { // 3. Constant-time response padding to eliminate timing side-channels const elapsed = performance.now() - startTime; const delay = Math.max(0, MINIMUM_PROCESSING_MS - elapsed); setTimeout(() => { if (accountPayload.length === 0) { res.status(401).json({ accounts: [] }); } else { res.status(200).json({ accounts: accountPayload }); } }, delay); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: FedCM Cross-Origin Partition Isolation and Side-Channel Mitigation Standard

FedCM Cross-Origin Partition Isolation and Side-Channel Mitigation Standard defines an industrial-grade behavioral standard for security engineering. Enforces strict partition isolation and constant-time execution across W3C Federated Credential Management (FedCM) endpoints. Prevents relying party timing side-channels, cross-site identity leakage, and covert user tracking during unmediated or silent identity provider handshakes under third-party cookie deprecation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Variable-latency accounts endpoint execution and missing Sec-Fetch-Dest validation enabling cross-site login state probing Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Variable-latency accounts endpoint execution and missing Sec-Fetch-Dest validation enabling cross-site login state probing	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST validate that the incoming request contains `Sec-Fetch-Dest

Services MUST validate that the incoming request contains `Sec-Fetch-Dest: webidentity` and explicitly disallow ambient credential inheritance outside browser-mediated FedCM invocations.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.