FedCM tutorial should mention CORS header requirement

[jespertheend]

MDN URL

https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API/IDP_integration

What specific section or headline is this issue about?

https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API/IDP_integration#the_id_assertion_endpoint

What information was incorrect, unhelpful, or incomplete?

The assertion endpoint never mentions the requirements that need to be met for a request to succeed.

What did you expect to see?

This request fails when the endpoint doesn't respond with the correct CORS headers, specifically:

• Access-Control-Allow-Origin: https://rp.example
• Access-Control-Allow-Credentials: true

Chrome currently gives a rather unhelpful error message in the browser console when this requirement isn't met:

The fetch of the id assertion endpoint resulted in a network error: ERR_FAILED

Do you have any supporting links, references, or citations?

https://developers.google.com/privacy-sandbox/cookies/fedcm/implement/identity-provider#id-assertion-endpoint
https://groups.google.com/a/chromium.org/g/blink-dev/c/gYoQJsaiD9E

Do you have anything more you want to share?

No response

MDN metadata

Page report details

• Folder: en-us/web/api/fedcm_api/idp_integration
• MDN URL: https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API/IDP_integration
• GitHub URL: https://github.com/mdn/content/blob/main/files/en-us/web/api/fedcm_api/idp_integration/index.md
• Last commit: 2b6f99e
• Document last modified: 2024-08-17T01:09:59.000Z

[jespertheend]

Also it might be worth mentioning that the Access-Control-Allow-Origin header should be set to the explicit origin of the requester. So setting "*" as value will not suffice.