 Natalia Markoborodova [X](https://twitter.com/nmarkoborodova) [GitHub](https://github.com/ewewraw) [LinkedIn](https://www.linkedin.com/in/natalia-markoborodova) [Bluesky](https://bsky.app/profile/nmarkoborodova.bsky.social)
Published: August 27, 2026
Chrome 152 introduces [Connection Allowlists](https://developer.chrome.com/blog/connection-allowlists-origin-trial.md.txt),
a mechanism that lets you specify the exact URL patterns permitted for network
communication on your site. While this network sandbox helps prevent
unauthorized data exfiltration, a strict allowlist might unintentionally block
legitimate services.
If your site relies on federated authentication *and* uses Connection
Allowlists, you must allowlist your Identity Provider's endpoints so users can
sign in. If you don't use Connection Allowlists, no action is required.
## What Connection Allowlists mean for FedCM requests
On the site where the user is signing in, the FedCM API makes network requests
to the following Identity Provider endpoints:
- [.well-known file](https://developer.chrome.com/docs/identity/fedcm/implement/identity-provider#well-known-file)
- [Config file](https://developer.chrome.com/docs/identity/fedcm/implement/identity-provider#idp-config-file)
- [Accounts](https://developer.chrome.com/docs/identity/fedcm/implement/identity-provider#accounts-list-endpoint)
- [ID assertion](https://developer.chrome.com/docs/identity/fedcm/implement/identity-provider#id-assertion-endpoint)
- [Disconnect](https://developer.chrome.com/docs/identity/fedcm/implement/identity-provider#disconnect)
- [Client metadata](https://developer.chrome.com/docs/identity/fedcm/implement/identity-provider#client-metadata-endpoint)
With Connection Allowlists, you can control which endpoints your site is allowed
to communicate with using a `Connection-Allowlist` HTTP response header. If an
allowlist is set up but doesn't include your Identity Provider's endpoints, your
FedCM integration may not work as expected.
## For relying parties: Allowlist your Identity Provider
When configuring a Connection Allowlist, you must ensure you include all the
services you want your site to communicate with. If your users sign in with an
Identity Provider, you should add its endpoints to the allowlist. You can
include the Identity Provider endpoints using a wildcard:
```javascript
// Allow network requests to any of the Identity Provider endpoints
Connection-Allowlist: ("https://idp.example/*" response-origin)
```
> [!NOTE]
> **Note:** Connection Allowlists are an opt-in feature in Chrome 152. If an allowlist is not configured, any network request initiated on the site is allowed.
## For identity providers
If you are an Identity Provider, you don't need to update your code. However, we
recommend updating your documentation to inform Relying Parties about the
specific endpoints they need to allowlist to keep their integrations working
properly.
## Resources
- [Learn more about FedCM](https://developer.chrome.com/docs/identity/fedcm/overview.md.txt)
- [Learn more about Connection Allowlists](https://developer.chrome.com/blog/connection-allowlists-origin-trial.md.txt)
- [Stay up to date with Chrome developer announcements](https://developer.chrome.com/blog)
- [Identity solutions available on Chrome](https://developer.chrome.com/docs/identity)