---
title: "Embedded Login Considerations"
slug: "embedded-login-considerations"
updated: 2026-09-25T18:44:32Z
published: 2026-09-25T18:44:32Z
canonical: "docs.processmaker.com/embedded-login-considerations"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.processmaker.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Embedded Login Considerations

## Overview

ProcessMaker can be embedded within external websites using technologies such as iframes. While this approach can provide a seamless user experience, embedding the ProcessMaker login page introduces security, browser compatibility, authentication, and session-management considerations that should be evaluated before implementation.

This article outlines the potential risks and limitations associated with embedding the login experience in a customer-hosted website.

---

## Important Considerations

### Third-Party Cookies

Embedded login experiences typically rely on browser cookies to maintain authenticated sessions. When ProcessMaker is hosted in an iframe on a different domain, browsers may treat these cookies as third-party cookies.

**Considerations**

- Requires cookies to be configured with `SameSite=None; Secure`.
- Some browsers restrict or block third-party cookies even when correctly configured.
- Authentication and session persistence may be affected by browser privacy settings.

---

### Cross-Site Request Forgery (CSRF)

Embedding the login page in another website increases exposure to cross-site requests.

**Considerations**

- Cross-site requests can introduce additional attack vectors.
- CSRF protection mechanisms should remain enabled.
- Origin validation and anti-forgery protections should be maintained to help prevent unauthorized requests.

---

### Clickjacking

Clickjacking occurs when a page is embedded within another website and users are unknowingly tricked into interacting with hidden or disguised elements.

**Considerations**

- An attacker could display the login page within a malicious website.
- User actions may be manipulated through deceptive page layouts.
- Appropriate frame and content-security protections should be evaluated before allowing embedded login scenarios.

---

### Phishing Risks

An embedded login page may appear to users as a native component of the hosting website.

**Considerations**

- Users may not easily distinguish between the customer website and ProcessMaker authentication pages.
- A compromised host website could alter surrounding content to mislead users.
- Organizations should provide clear branding and authentication guidance to users.

---

### Single Sign-On (SSO)

Embedded authentication can affect SAML and OpenID Connect (OIDC) authentication flows.

**Considerations**

- Identity providers may block authentication redirects within iframes.
- Browser security restrictions can interrupt SSO workflows.
- The current authentication model relies on redirects and session cookies and is not specifically designed for embedded login scenarios.

---

### Logout and Session Management

Browser restrictions can affect how sessions are created, maintained, and terminated within embedded environments.

**Considerations**

- Logout operations may not fully clear cookies restricted by third-party cookie policies.
- Session state may become inconsistent between the iframe and the primary browser window.
- Users may remain authenticated in one context after logging out in another.