We have a web application, where other partners can include their pages as iframes. We implemented a server-to-server way of authenticating users for the iframes, but one partner doesn't want to implement it.
The bad thing is, they also don't want to display their login page in the iframe in order not to be vulnerable to javascript key loggers.
We always bind in iframes with sandbox="allow-forms allow-scripts allow-top-navigation-by-user-activation allow-same-origin"
- that's of course to guarantee the security on our side, I couldn't find any place where the iframe server could request sandbox to be active. Is there a way for them to do it, or would they just have to trust us?
Also, does the sandbox
attribute guarantee that we cannot log key strokes which were created while the focus was on their iframe? - I thought it would guarantee it, but I couldn't find it anywhere documented.
Regarding server making sure that the iframe can't be loaded into any malicious page, they could simply white list us with header https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options or?