I’m not embedding Discourse in a iframe. I’m using the API to show a topic messages.
I’m not trying to login/signup inside an iframe because social websites doesn’t allow to be displayed inside them.That’s why, when user clicks on a button inside the iframe, it opens a new browser tab to /login page on Discourse.
Technically, when user hits the login button, a new tab is opened with /session/sso_provider. return_sso_url will contain an url to backend to process the data, save the user’s session infos then responding some HTML to auto-close the window. The app then will detect it’s done and will be reloaded automatically so it can use the saved user’s session.
Even if the app was not in a iframe, It would likely happen the same. Since it’s a browser extension, you have no choice to open a new tab anyway. I’m wondering there are better ways to login/signup in this case.
EDIT: Here a demo (was not meant to public, but well, that the shortest way to show the issue and I feel like I don’t explain well enough) :
snip, video removed, no one care anyway
EDIT2: Seems to happen only when using the API /session/sso_provider ; if I do open Discourse url directly (still from an iframe), it seems the issue doesn’t happen.