Lots of sites embed an iframe from a different origin that handles authentication for them. This is sometimes a third party, or maybe it's a separate service run by the same party. One obvious example is icloud.com, which uses apple.com for authentication.
Should we support such cases? If so, why, and how would the spec need to change? If not, why not?
Lots of sites embed an iframe from a different origin that handles authentication for them. This is sometimes a third party, or maybe it's a separate service run by the same party. One obvious example is
icloud.com, which usesapple.comfor authentication.Should we support such cases? If so, why, and how would the spec need to change? If not, why not?