Why is a iFrame used for Silent Authentication?

Question

I've read on multiple pages that hidden iFrames are used for silent authentication, but I couldn't figure out yet why. What are the benefits to using an iFrame over directly sending a GET Request to the Identity Server?

Answer 1

It's a convenient way to get around the Single-Origin-Policy in the browser when we want to do cross-origin requests (across domains).

This was a popular approach when we didn't have the more modern CORS feature to get around the SOP-policy.

Here's some additional resources about this:

• How to handle third-party cookie blocking in browsers
• The Impact of Blocked Third-Party Cookies on WSO2 Identity Server