I'm developing info.client.com, which is hosted on the client's Apache server. The client's main site, www.client.com, is hosted by a third-party service and embeds info.client.com in an iframe. Users can log in successfully on both sites when visiting them directly, but the client wants the iframe to recognize the session that is already active on the parent page.
I considered sharing a cookie across both subdomains by using a Domain=.client.com cookie. However, the hosted main site currently uses a __Host- HttpOnly cookie scoped to www.client.com, so the Apache server cannot read or validate it. I also considered having the parent site issue a JWT containing the necessary user information and passing it to the iframe for validation.
I control info.client.com and may be able to get the hosting provider to make limited changes to www.client.com. What is the standard and safest pattern for passing the parent site's authenticated state to an embedded iframe?
2 Answers
The token handoff is probably the best fit here. Have the parent site obtain a short-lived, narrowly scoped token from the authentication system, then send it to the iframe with window.postMessage. The iframe should verify the message origin, send the token to its backend over HTTPS, validate its signature or exchange it with the authentication service, and create its own short-lived session.
Avoid putting a bearer token in the iframe URL because URLs can leak through browser history, logs, analytics, and referrer headers. Also make sure the parent can request a fresh token rather than reusing a long-lived one.
Sharing a cookie only works if the parent system actually issues a cookie that is valid for the shared parent domain and both applications can use the same session format. A __Host- cookie cannot be shared: it must be host-only and cannot have a Domain attribute. Since the hosted site owns that cookie and its internal session, your server has no reliable way to interpret it.
If the provider can add a small integration that requests a short-lived assertion for the current user and posts it to the iframe, that gives you the same result without exposing or copying the provider’s session cookie.
Related Questions
How to Build a Custom GPT Journalist That Posts Directly to WordPress
Cloudflare Origin SSL Certificate Setup Guide
How To Effectively Monetize A Site With Ads