Security Assist page in iframe - different domain

I have created an app using DataAssist and Security Assist.
When I browse directly to the login page, everything works perfectly.

Deployment however has the app in an iframe on one domain (the content being on a second domain)

Browse to DomainA, go to page holding iframe pointed at content on DomainB
Login works fine with Firefox, but not with Internet Explorer.

I'm stumped. The action of logging in takes place on DomainB regardless of the fact that the page is held in a frameset. It should be seamless, but it is not. In IE, my login fails if the login page is held in an iframe, but works if browsed directly.

This is a limitation to iFrames.


Regardless of the fact that the page is being served in an iframe on domain A, the session cookie that is created when you login is for domain B.

The iFrame cannot see the session cookie for domain B though, it can only see the session cookie for the page that is hosting the iFirame.

Thank you,
Strange that it works in Firefox. I backtested IE6 and it also failed in IE6.

The iFrame was a Microsoft creation. It is not a part of the W3C standard. I believe it was first introduced as part of IE5. When it was first introduced, you could only use iFrames in IE, other browsers did not support it.

since it is not a standard part of the HTML specification, you will get mixed results across browsers. Since it is an element created by Microsoft for IE, I would say the IE behavior is correct. This is a rare instance where FireFox is not implementing the element correctly.