(Disclaimer: not a security expert, opinions could be wrong.) > You shouldn't enter your username and password for one website into another. A stronger versio

(Disclaimer: not a security expert, opinions could be wrong.) > You shouldn't enter your username and password for one website into another. A stronger version of this is you shouldn't embed any kind of authentication/authorization widget of one website into another, even if the widget is supposedly under complete control of the auth provider (i.e. an iframe). For instance, is an embedded SSO widget without password entry okay? No. Cue Google YOLO clickjacking.[1][2] There's a reason OAuth forbids iframe embedding and even recommends JS frame-busting on browsers that don't support X-Frame-Options.[3] [1] https://blog.innerht.ml/google-yolo/ https://blog.innerht.ml/google-yolo/ [2] https://news.ycombinator.com/item?id=17044518 https://news.ycombinator.com/item?id=17044518 [3] https://datatracker.ietf.org/doc/html/rfc6749#section-10.13 https://datatracker.ietf.org/doc/html/rfc6749#section-10.13