I have a main website that embeds 3 other websites via iframes (legacy systems providing various functionalities with a user interface). Currently the user has to authenticate with each of the system despite that they are all using the same authorization server. In order to make it user-friendly I was thinking to share the access token across the various iframes using the HTML5 messaging API and I was wondering whether this approach is viable from a security point of view?
The postMessage API is designed for cross domain communication as part of the Cross Origin Resource Sharing mechanism.
The classical rules of security also apply to applications using postMessage(). You are planning to use this method for sharing authentication information which is perfectly fine if you you follow basic input validation rules while implementation.
Never broadcast your auth tokens: Your scenario contains multiple different parties who need to have access to a common token. you might be tempted to broadcast the authentication information so that all the iframes get access to it. This may result in unauthorized access to your tokens. Hence the postMessage() call should always specify the target origin.
Always validate message origin: You need to validate that the message has been received from a valid and expected origin. Only after origin validation you should proceed with using the message in the application logic. Imagine a case where your app is iframed by a malicious domain. If you do not validate the origin of the message it may result in script injection.
Additionally, depending on your trust relationship with the authorization server, you may want to validate the token itself once the sender origin is validated.
For a more detailed analysis of postMessage() API security along with a few example code snippets, refer to my Blog
You can read about the rules that modern browsers follow on cookie and domain access control: RFC6265
IFrames for many reasons are not recommended (Like SEO, google indexing, Security,...).
The new version of browsers with default cookie domain configuration are 99% secure in this subject. However, the most security risks in IFrame (and browsers) history were about CSRF and XSS. So if you protect your sites by CSRF tokens and XSS filtering methods + Correct cookie domain configuration, even with a vulnerable browser it's approximately safe to use IFrame.