In a browser I want to use SublteCrypto (https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto) to create a key pair and store it locally in the IndexedDB (https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API).
I need to share the key pair among a restricted list of different domains. However, browsers restrict IndexedDB to first party origin, so it cannot be accessed within an IFrame.
Another solution that seems to work only in Google Chrome but not Firefox is to do the cross-domain access of the keys via a new (temporary) browser window opened by
window.open. This has the disadvantage that I always need to open a distracting window when accessing the keys. Of course this works only with user interaction as
window.open is only allowed when triggered directly by the user, which should not be a problem in my case. Surprisingly that works pretty well in Google Chrome and I can use the key pair from the IndexedDB cross-origin with some window messaging. Maybe a security bug?
Firefox however seems to block access to the IndexedDB in that case. Access is only given when manually opening the window to the origin where the keys are stored.
Any ideas how to use SubtleCrypto with non-extractable keys stored in IndexedDB cross origin in a clean way that works with all browsers supporting that features?