We have a web application, where other partners can include their pages as iframes. We implemented a server-to-server way of authenticating users for the iframes, but one partner doesn't want to implement it.
We always bind in iframes with
sandbox="allow-forms allow-scripts allow-top-navigation-by-user-activation allow-same-origin" - that's of course to guarantee the security on our side, I couldn't find any place where the iframe server could request sandbox to be active. Is there a way for them to do it, or would they just have to trust us?
Also, does the
sandbox attribute guarantee that we cannot log key strokes which were created while the focus was on their iframe? - I thought it would guarantee it, but I couldn't find it anywhere documented.
Regarding server making sure that the iframe can't be loaded into any malicious page, they could simply white list us with header https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options or?