We have application which will be in iframe. Partner sites can use our application - put iframe in their sites.
Partner site has users with money, who will use our application in iframe to buy items. Iframe needs communicate with partner site.
For example user buys item. Our app creates a record about sold item in database.
Then it sends request to partner app - so the partner would know that his user bought an item, and could reduce his money in the account.
User does not have to login to our app, it only has to login to partner application - parent site and use our iframe as logged in.
How is this done in secure way? I know there is site which does that without visible tokens in ajax requests, so there is probably some session in the child app. Session, not requiring username and password.
I would like to get some tutorials with schema. Tried to search but not even sure how to make keywords for such question.
Update
What about this, are you seeing what could be potentially insecure? :
When partner page is loaded, there is iframe and in get parameter token is passed to iframe, like <iframe src='www.shop.com?token=12345'><iframe>
Iframe on load in server side - requests new token from the partner site passing as parameter the token which is in url as $_GET parameter.
That way the token in the iframe url get parameter becomes invalid, so even when user see it, he cannot do anything.
New token which is received in iframes server is saved in session.
So now from client side - when client buys and item in iframe, he does not need to pass token in request, because it is in session.
Iframe server when receives request, does buy item and send request to partner server info about buying item, so the partner could reduce the money. In this request token is is passed to partner server from session.
Partner server recognizes the user by token and reduces his money in the account.
