Re:The Benefits of Iframe Based Development
by fjert on Tuesday November 02, 2021 @05:47PM
(#29087856)
I recently had to deal with the headaches of cookies and iframes. In my case, it was learning management software that used our external tool loaded in an iframe via LTI. I was specifically dealing with Safari but understood other browsers could become as strict as Safari for cookies in iframes.
After pursuing methods of getting user consent to use 3rd party cookies via the storage API, the end result was the user jumping through hoops by repeatedly clicking buttons to invoke user interaction in different contexts to eventually get a prompt to allow cookies. It did work, but there were strange bugs with it on mobile Safari... e.g., the prompt to allow cookies never appeared after clicking the button but after putting Safari in the background and going back to it, it did appear.
The UX of all this was pretty undesirable so we just gave up and had the tool open in a full window and wondered why we didn't think to do that from the beginning.
Avoiding cookies in iframes is important because browsers are getting more restrictive, so security for iframes is difficult to manage. We passed a unique session token to the iframes from the owning page using postMessage(), and the two servers (we controlled both) communicated directly for authentication (avoid putting authentication into the browser since your enemy controls it completely).
I have always found trying to use iframes as a visible section of your UI is really crappy. Troubles with keyboard focus, resizing, modal dialogs, scrolling, Mobile Safari quirks, detecting loading or other failures, yada yada yada.