I am working on an app that performs authentication through an SSO (Single Sign On Service). Both sign-in and sign-out processes are carried out after redirection to the SSO page. Currently, this app can work standalone and also embedded utilizing iframe. The problem is with the last scenario: framed by another app. For this case, the SSO startup is prevented - the parent app would be responsible for that. The first attempt to detect if the child app is running inside an iframe or not was checking the following:
window.parent.location !== window.location
The above statement is hosted by the child app. So, by comparing the locations objects would be possible to infer the current context and if, necessary, prevent the SSO's startup inside the child app. At first glance, this solution looked to be enough however, it is not. When performing the sign-out, the parent app is redirected to the SSO logout page. Aftward, the SSO redirects back to the app's base path (via redirect_uri param). The problem is, when returning from SSO, the comparison seems to be evaluated before the child window is ready. So still on the SSO logout page, the scripts from the child app are triggered and as a result, the statement shown above is always true which blocks the startup from happening even when in a no-framed context. During this moment, the scripts from the child app are pointing out to the SSO windows object instead of its window which would be correct.
Maybe this uncommon behavior is related to the way that the browser render engine works. Maybe evaluating scripts beforehand, even though the graphical interface is still located on the SSO logout page.
Is there some solution/recommendation for this specific case?
Thank you so much.