We have application which will be in iframe. Partner sites can use our application - put iframe in their sites.

Partner site has users with money, who will use our application in iframe to buy items. Iframe needs communicate with partner site.

For example user buys item. Our app creates a record about sold item in database.

Then it sends request to partner app - so the partner would know that his user bought an item, and could reduce his money in the account.

User does not have to login to our app, it only has to login to partner application - parent site and use our iframe as logged in.

How is this done in secure way? I know there is site which does that without visible tokens in ajax requests, so there is probably some session in the child app. Session, not requiring username and password.

I would like to get some tutorials with schema. Tried to search but not even sure how to make keywords for such question.


What about this, are you seeing what could be potentially insecure? :

When partner page is loaded, there is iframe and in get parameter token is passed to iframe, like <iframe src='www.shop.com?token=12345'><iframe>

Iframe on load in server side - requests new token from the partner site passing as parameter the token which is in url as $_GET parameter.

That way the token in the iframe url get parameter becomes invalid, so even when user see it, he cannot do anything.

New token which is received in iframes server is saved in session.

So now from client side - when client buys and item in iframe, he does not need to pass token in request, because it is in session.

Iframe server when receives request, does buy item and send request to partner server info about buying item, so the partner could reduce the money. In this request token is is passed to partner server from session.

Partner server recognizes the user by token and reduces his money in the account.

  • 2
    I have come across with same kind of situation, Would it be still recommanded to pass JWT tokent as part of query string while loading an IFrame?
    – Denish
    Jun 27, 2018 at 7:08

1 Answer 1


First, it's not a good idea as far as I know to put a secure application in an iframe because that expose you to security issue. The biggest one is probably clickjacking if all else is done correctly. This is why you want to use the header option X-FRAME-OPTIONS to block it from loading in an iframe.

Next, you want to communicate between the partner site and your own site, in the iframe. The communication between the 2 is very limited because of the same origin policy. If 2 websites, don't have the same base url, which means they don't have the same origin, can't directly talk together. Which is a very good thing or you would have big security issue.

User does not have to login to our app, it only has to login to partner application - parent site and use our iframe as logged in.

This assume that you trust every partner site at 100% since they have all the information needed to log in to your site. Is it the case?

The type of login you are trying to do is similar to OAuth, where third party are granted partial access to your site in order to access some information. It's not exactly what you want to do, but I would look at how it's done.

  • 1
    yea, we kind of trust our partner, I mean, partner will not be able to access what we don't let him access. We just give to partner secret key and public key and he should be able to buy items.
    – Darius.V
    Jul 23, 2014 at 5:35
  • I think you can get around the X-FRAME-OPTIONS for a trusted site Jul 27, 2016 at 22:22
  • (by adding an exception for the one trusted site) Jul 27, 2016 at 22:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .