In general, CSRF protection means this: "compare <input type=hidden> with a value in user's session" (or sometimes - user cookie).

Now, suppose I want my app/website to be iframe compatible (while still protecting from CSRF "session-riding" attacks).

However, newer browser versions will disable setting a cookie inside iframes. Chrome has this in their roadmap for 2021 and they are already enforcing this in incognito tabs (see this answer)

Which means, that every navigation event inside an iframe (clicking a link or POST-ing a form) creates a new Session ID (because the Set-Cookie: MY_FRAMEWORKS_SESSION_ID will be ignored by the browser).

So... What do we do? How do we stay iframe-friendly, while still preventing CSRF?

(apart from "do not use iframes" answer)

1 Answer 1


I don't think that this should be a problem, for at least two reasons

  • you shouldn't need CSRF protection for framable pages. If the page had state-changing functionality which needed to be protected from CSRF, then it also needs to be protected from Clickjacking, so it shouldn't be framable in the first place.
  • you shouldn't need to be able to set new cookies in your iframe for the double-submit cookie prevention mechanism (any cookie that was previously set should still work, and there is no need to regenerate it).

But assuming that for some reason these issues do not apply, you could use one of the other CSRF prevention techniques,eg:

  • custom request header (ajax requests cannot be sent cross origin with custom headers unless allowed by the CORS policy)
  • verify origin header (or referer)
  • using a stateless encrypted token
  • 2
    Thanks, upvoted and marked as "accepted", looking at other CSRF techniques. As for the "shouldn't be framable in the first place" part - well, there are use cases where this is untrue. We are developing an embeddable "live-chat" support widget, that runs in an iframe, while still trying to make it secure and immune to session-hijacking.
    – Alex
    Commented Sep 17, 2020 at 20:54
  • 2
    @Alex how did you solve this, I think I have the same use as yours.
    – ssasi
    Commented Dec 19, 2022 at 12:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .