Login Status API

1. Introduction

This section is non-normative.

Note: use the following introduction: https://github.com/fedidcg/login-status

2. Login Status Map

Each user agent keeps a global, persistent Login Status map, an initially empty map. The keys in this map are origin (of IDPs), and the values are enums that can be one of "unknown", "logged-in", and "logged-out".

3. Infrastructure algorithm

4. HTTP header API

IDPs can set the login status using an HTTP response header as follows.

The HTTP header checking should move into the Fetch spec, since it affects all resource loads.

For each http-redirect fetch and http fetch's response, let value be the result of get a structured field value from the response’s header list with name "Set-Login" and type "item". If value is not null, process this header as follows:

5. JavaScript API

IDPs can also use a JavaScript API to update the stored login status:

enum LoginStatus {
  "logged-in",
  "logged-out",
};

[Exposed=Window, SecureContext] 
interface NavigatorLogin {
  Promise<undefined> setStatus(LoginStatus status);
};

partial interface Navigator {
  [SecureContext] readonly attribute NavigatorLogin login;
};

6. Clearing the Login Status Map data

User agents MUST also clear the Login Status map data when:

the user clears all cookies or site settings data

The user agent MUST clear the entire map.

the user clears all cookies or all site data for a specific origin

The user agent MUST remove all entries that would be affected by the deleted cookies, that is, any entry with an origin to which a deleted cookie could be sent to.

Note: For example, domain cookies may affect subdomains of the deleted origin, e.g. clearing cookies for google.com should also reset the login status for accounts.google.com, since it may rely on a domain cookie for google.com.

the user deletes individual cookies (if allowed by the user agent)

the behavior is user agent-defined.

Note: The user agent MAY want to reset the state to unknown, since is impossible to know whether this cookie affects authorization state.

the user agent receives a Clear-Site-Data header with a value of "cookies" or "*", and the request's client is not null, and the client’s origin is same origin with the top-level origin

while clearing cookies for origin it MUST remove any entries in the Login Status Map where the key is the input origin.

Once Clear-Site-Data supports partitioned cookies, this wording should be updated.

Note: Other website-initiated cookie changes should not affect this map. When IDP login state changes, it should send an explicit Set-Login header. RP state should not affect this map since it only reflects IDP state.

7. Acknowledgements

Note: write down the Acknowledgements section.