I have a main website that embeds 3 other websites via iframes (legacy systems providing various functionalities with a user interface). Currently the user has to authenticate with each of the system despite that they are all using the same authorization server. In order to make it user-friendly I was thinking to share the access token across the various iframes using the HTML5 messaging API and I was wondering whether this approach is viable from a security point of view?

  • There's a standard solution to this problem, which is to implement SSO with OpenID/OAuth protocol. You might want to either use existing libraries that implements these protocols or read their code for ideas on how you can design yours.
    – Lie Ryan
    Oct 6, 2017 at 7:25

2 Answers 2


The postMessage API is designed for cross domain communication as part of the Cross Origin Resource Sharing mechanism.

The Window.postMessage() method, introduced in HTML5, allows JavaScript code running on different origins to communicate with each other in a bidirectional manner. This API can be used for communication between an iframe and its parent document. Similarly, it can be used by an HTML page and a child window to exchange messages, such as an embedded third-party video notifying its parent frame when the user pauses the video.

The classical rules of security also apply to applications using postMessage(). You are planning to use this method for sharing authentication information which is perfectly fine if you you follow basic input validation rules while implementation.

  1. Never broadcast your auth tokens: Your scenario contains multiple different parties who need to have access to a common token. you might be tempted to broadcast the authentication information so that all the iframes get access to it. This may result in unauthorized access to your tokens. Hence the postMessage() call should always specify the target origin.

  2. Always validate message origin: You need to validate that the message has been received from a valid and expected origin. Only after origin validation you should proceed with using the message in the application logic. Imagine a case where your app is iframed by a malicious domain. If you do not validate the origin of the message it may result in script injection.

Additionally, depending on your trust relationship with the authorization server, you may want to validate the token itself once the sender origin is validated.

For a more detailed analysis of postMessage() API security along with a few example code snippets, refer to Mcafee's Blog

  • 1
    @WashingtonGuedes Fixed it. It has been years and it seems they moved the company blog.
    – Shurmajee
    Jun 18, 2020 at 18:47

You can read about the rules that modern browsers follow on cookie and domain access control: RFC6265

IFrames for many reasons are not recommended (Like SEO, google indexing, Security,...).

The new version of browsers with default cookie domain configuration are 99% secure in this subject. However, the most security risks in IFrame (and browsers) history were about CSRF and XSS. So if you protect your sites by CSRF tokens and XSS filtering methods + Correct cookie domain configuration, even with a vulnerable browser it's approximately safe to use IFrame.

  • 4
    This question is likely about the postMessage API and has nothing to do with cookies.
    – Lekensteyn
    May 8, 2017 at 8:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .