When working on this, we need to control the circumstances where embedding is possible. Allowing embedding across the board without limitations could have security implications. Security scanner tools like Nessus complains about the current headers sent by Web Access, saying that there is a potential vulnerability to “Clickjacking”: https://www.tenable.com/plugins/nessus/85582 In short, headers “X-Frame-Options” or “Content-Security-Policy” could possibly give us the control we need: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
In a related fix, bug 8192, the SameSite attribute for cookies was explicitly set to Lax to align with modern browser behaviour and improve cross-site request security. This change was made to ensure predictable cookie handling and will prevent embedding Web Access in an iframe.
Another thing to note, the "Secure" attribute must be set when using SameSite=None
