There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to visit Host which embeds App as an IFrame. While App is fully trusted, Host is more likely to get compromised, and shouldn't be able to access confidential information intended only for App.

In several situations App must generate URLs that ultimately redirect to a certain App page embedded on the Host domain, but also pass on confidential information directly to App. The URLs need to be self sufficient, i.e. they must work in a newly set up browser without any history or cached data.

Question: Are there any best practices or recommendations on how to pass such information in a secure manner?

As a side note I can see that there are other, maybe even more critical security concerns in a setup like this, e.g. phising. Comments on those are welcome, too, but my main concern is building URLs like described above.

  • the host cannot see the URLs of the frame. You can re-nav the frame without the use of the framing page. It still would be cleaner to use sessionStorage instead of long URLs like we need for stateless client-server interaction; no need to export/load/parse URLs with that method, and it all stays safe in the domain of the embed.
    – dandavis
    Commented Aug 25, 2020 at 19:29
  • For this API's were invented, working with iframes in 2020 is not done in my opinion.
    – Jeroen
    Commented Aug 25, 2020 at 19:48
  • @dandavis Do you have a suggestion how I can tell the App where to re-navigate to? Passing this info through the Host is out of question and passing it through sessionStorage doesn't work because it's isolated between frames. I'm thinking about localStorage or cookies, but don't particularly like either of the two.
    – kremerd
    Commented Aug 25, 2020 at 19:48
  • 1
    Ah, if there's more than one frame you must use localStorage, which works fine, you just need to clean up after yourself, but that can be basically automatic if you always set the same key from each window and use onmessage events to subscribe to changes; the last message will remain, which should be a minimal "got it, valid" status object. If you need higher performance, developer.mozilla.org/en-US/docs/Web/API/SharedWorker or serviceWorkers are powerful options.
    – dandavis
    Commented Aug 25, 2020 at 21:13


You must log in to answer this question.

Browse other questions tagged .