Published: August 27, 2026
Chrome 152 introduces Connection Allowlists, a mechanism that lets you specify the exact URL patterns permitted for network communication on your site. While this network sandbox helps prevent unauthorized data exfiltration, a strict allowlist might unintentionally block legitimate services.
If your site relies on federated authentication and uses Connection Allowlists, you must allowlist your Identity Provider's endpoints so users can sign in. If you don't use Connection Allowlists, no action is required.
What Connection Allowlists mean for FedCM requests
On the site where the user is signing in, the FedCM API makes network requests to the following Identity Provider endpoints:
With Connection Allowlists, you can control which endpoints your site is allowed
to communicate with using a Connection-Allowlist HTTP response header. If an
allowlist is set up but doesn't include your Identity Provider's endpoints, your
FedCM integration may not work as expected.
For relying parties: Allowlist your Identity Provider
When configuring a Connection Allowlist, you must ensure you include all the services you want your site to communicate with. If your users sign in with an Identity Provider, you should add its endpoints to the allowlist. You can include the Identity Provider endpoints using a wildcard:
// Allow network requests to any of the Identity Provider endpoints
Connection-Allowlist: ("https://idp.example/*" response-origin)
For identity providers
If you are an Identity Provider, you don't need to update your code. However, we recommend updating your documentation to inform Relying Parties about the specific endpoints they need to allowlist to keep their integrations working properly.