Overview
ProcessMaker can be embedded within external websites using technologies such as iframes. While this approach can provide a seamless user experience, embedding the ProcessMaker login page introduces security, browser compatibility, authentication, and session-management considerations that should be evaluated before implementation.
This article outlines the potential risks and limitations associated with embedding the login experience in a customer-hosted website.
Important Considerations
Third-Party Cookies
Embedded login experiences typically rely on browser cookies to maintain authenticated sessions. When ProcessMaker is hosted in an iframe on a different domain, browsers may treat these cookies as third-party cookies.
Considerations
Requires cookies to be configured with
SameSite=None; Secure.Some browsers restrict or block third-party cookies even when correctly configured.
Authentication and session persistence may be affected by browser privacy settings.
Cross-Site Request Forgery (CSRF)
Embedding the login page in another website increases exposure to cross-site requests.
Considerations
Cross-site requests can introduce additional attack vectors.
CSRF protection mechanisms should remain enabled.
Origin validation and anti-forgery protections should be maintained to help prevent unauthorized requests.
Clickjacking
Clickjacking occurs when a page is embedded within another website and users are unknowingly tricked into interacting with hidden or disguised elements.
Considerations
An attacker could display the login page within a malicious website.
User actions may be manipulated through deceptive page layouts.
Appropriate frame and content-security protections should be evaluated before allowing embedded login scenarios.
Phishing Risks
An embedded login page may appear to users as a native component of the hosting website.
Considerations
Users may not easily distinguish between the customer website and ProcessMaker authentication pages.
A compromised host website could alter surrounding content to mislead users.
Organizations should provide clear branding and authentication guidance to users.
Single Sign-On (SSO)
Embedded authentication can affect SAML and OpenID Connect (OIDC) authentication flows.
Considerations
Identity providers may block authentication redirects within iframes.
Browser security restrictions can interrupt SSO workflows.
The current authentication model relies on redirects and session cookies and is not specifically designed for embedded login scenarios.
Logout and Session Management
Browser restrictions can affect how sessions are created, maintained, and terminated within embedded environments.
Considerations
Logout operations may not fully clear cookies restricted by third-party cookie policies.
Session state may become inconsistent between the iframe and the primary browser window.
Users may remain authenticated in one context after logging out in another.