Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Question

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required.

According to how SiteMinder cookies are described here, one of those domains would be the associated "master cookie" domain, and others would redirect to that domain in case of an authentication failure.

How things currently work

1. To prevent clickjacking, the login page for auth.com has the NoFrames script and a frames buster script implemented for older browers.

2. After the client logs into site1.com or site2.com, AJAX kicks in and does some operations (polling etc). During this time, Javascript may get a an error saying that the session is invalid. This error occurs while using AJAX. (if it occurred while browsing, there would be a redirection and this entire question doesn't apply)

3. At this point I can either refresh the page and redirect, or tell the user to login again at auth.com, but then I lose my in-memory application state.

A new/seamless approach for the end-user

As a workaround I'm considering using Javascript to create an iFrame to auth.com/RefreshOnly (iFrames okay) POSTing my session data. Auth.com/RefreshOnly will see the cookie for its domain and, if it chooses, redirect to my origin site1.com, instructing it to update my current cookie.... all within a hidden iFrame.

Question

Is this limited usage of iFrame permissible in an IDP/authentication provider? (not exclusive to Siteminder)

Answer 1

It seems to me that what you are proposing does not violate the normal workflow. You are making a request from the asserting party (site1 or site2, AP) to the service provider (auth-SP) which in turn is making a request to the identify provider (IdP).

It is also fairly common to implement this approach when a site accepts credit cards but doesn't want to accept the PCI regulatory burdens. A company like Cybersource serves as the SP and accepts user input in an iframe within the AP web page. As far as PCI (Payment Card Industry in case the acronym is obscure...) is concerned, it's no problem.

I'm not sure how the confirmation number is returned to the AP, but that doesn't much matter.