Add the iframe credentialless prop

[everettbu]

Mirror of facebook/react#35967
Original author: jamesbvaughan

---

Summary

This adds support for the iframe credentialless attribute. This is a (currently experimental) attribute that is useful for running iframes in pages using cross-origin isolation.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/IFrame_credentialless

The current workaround in React projects is to use credentialless="" (plus a // @ts-expect-error comment if you're using TypeScript).

How did you test this change?

I updated the automated tests and ran them. I'm having trouble with my local React build so I haven't yet been able to test this with my project, but I'll update this PR description once I have.

[greptile-apps]

Greptile Summary

This PR adds first-class support for the iframe credentialless boolean attribute across React's DOM bindings. The attribute is registered in all the expected locations: client-side prop setting, server-side rendering, hydration diffing, property validation, standard name mapping, and the attribute behavior test fixture. The changes follow the established pattern for boolean attributes (e.g., allowFullScreen, controls, inert) and are correctly placed in alphabetical order in each list.

• Adds credentialless as a recognized boolean prop in ReactDOMComponent.js (client), ReactFizzConfigDOM.js (SSR), and ReactDOMUnknownPropertyHook.js (validation)
• Registers the lowercase-to-React-prop mapping in possibleStandardNames.js
• Adds a test fixture entry for the attribute on <iframe> elements
• One suggestion: consider adding the same __DEV__ empty-string warning that inert has, since users are currently working around the missing support with credentialless="" and would benefit from a migration hint

Confidence Score: 4/5

• This PR is safe to merge — it adds a standard boolean attribute following well-established patterns with no risk of breaking existing behavior.
• The changes are minimal, mechanical, and follow the exact same pattern used for every other boolean attribute in the codebase. All required locations are updated consistently. The only suggestion is an optional DX improvement (empty-string warning), not a correctness issue.
• No files require special attention. All changes are simple case additions to existing switch statements.

Important Files Changed

Filename	Overview
packages/react-dom-bindings/src/client/ReactDOMComponent.js	Adds credentialless to the boolean attribute case lists in setProp and diffHydratedGenericElement. Correctly placed in alphabetical order. Could benefit from the same empty-string warning as inert given the known credentialless="" workaround.
packages/react-dom-bindings/src/server/ReactFizzConfigDOM.js	Adds credentialless to the boolean attribute case list in pushAttribute for server-side rendering. Correctly placed in alphabetical order. Same empty-string warning consideration applies.
packages/react-dom-bindings/src/shared/ReactDOMUnknownPropertyHook.js	Adds credentialless to both boolean property validation lists — for accepting boolean values and for warning on string 'true'/'false'. Correctly placed.
packages/react-dom-bindings/src/shared/possibleStandardNames.js	Registers credentialless in the lowercase-to-React-prop name mapping. Since the attribute name is already all lowercase, the mapping is identity — correct.
fixtures/attribute-behavior/src/attributes.js	Adds test fixture entry for credentialless on iframe elements, using getProperty reader — correctly matches the boolean property pattern.

_{Last reviewed commit: 5901780}

[greptile-apps]

Consider adding an empty-string warning like inert

Since the PR description notes that the current workaround is credentialless="", users upgrading will likely pass an empty string initially. The inert attribute (line 740) was added with a __DEV__ warning for empty-string values for exactly this reason — it falls through to the boolean list below after emitting the warning.

It may be worth giving credentialless the same treatment: adding a dedicated case 'credentialless' block above the fallthrough list (alongside inert) that warns when value === '', so users get a helpful nudge to switch to credentialless={true}. This would affect 3 locations: setProp, pushAttribute in ReactFizzConfigDOM.js, and diffHydratedGenericElement.

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/react-dom-bindings/src/client/ReactDOMComponent.js
Line: 759

Comment:
**Consider adding an empty-string warning like `inert`**

Since the PR description notes that the current workaround is `credentialless=""`, users upgrading will likely pass an empty string initially. The `inert` attribute (line 740) was added with a `__DEV__` warning for empty-string values for exactly this reason — it falls through to the boolean list below after emitting the warning.

It may be worth giving `credentialless` the same treatment: adding a dedicated `case 'credentialless'` block above the fallthrough list (alongside `inert`) that warns when `value === ''`, so users get a helpful nudge to switch to `credentialless={true}`. This would affect 3 locations: `setProp`, `pushAttribute` in `ReactFizzConfigDOM.js`, and `diffHydratedGenericElement`.

How can I resolve this? If you propose a fix, please make it concise.