Cross domain with an Iframe, pointing to SSO server

Question

I have an application, where I am displaying some stuff in javasctip modals using jquery. It req. user to login for certain flows; but we never leave modal for user.

So here is what we do currently.

1. During user flow if user needs to be logged in, we hide current div and show a login div
2. Keep a hidden iframe with Source link as that of our SSO server.
3. Once user submits the form, we submit the hidden iframe to the SSO server
4. If user gets logged in we proceed with the flow.

Problem is when there is error for user login. We need to get the error codes from the hidden iframe of the page; but because we don't control the content inside iframe, and it's returned by SSO server; we don't know how to read it since it's cross domain.

Any insights?

Answer 1

So long as there is not client side script being executed from the SSO party you do not need the iframe. The point of using an iframe for security is to prevent AJAX methods from ignoring single origin policy and circumventing SSL encryption. The answer is to remove the iframe. Request the SSO data from the server side and send it to the client from your server as the page is built.