Yii2 Bad Request 400 - Unable to login from iframe on another domain

Question

I am using iframe on domain1.com And the yii2 web app is on domain2.com

I am have passed domain.com url in the src of iframe on domain1.com and use this in the yii2 Access-Control-Allow-Origin: * to enable cors

I can login on domain2.com but it throws bad request 400 error if I try logging in through iframe on domain1.com

Any help would be really appreciated

Answer 1

Here is the answer to my question, I solved the problem

• Change the PHP version to >7.3
• Go into the config/web.php for basic app or config/main.php
• Add this: 'httpOnly' => true, 'secure' => true, 'samesite' => 'None' in _csrf param for request block and _identity cookie in the user block

Using this you would be able to log into the domain1.com and domain2.com using same session on both the domains if the site is in iframe in the domain1.com