What security issues may exist when using FIDO authentication in <iframe>

[haodong zhou]

At present, the webauthn protocol already supports the use of "navigator. credentials. get()" and "navigator. credentials. create" in<iframe>, but it seems that the webauthn GitHub community still has significant objections to the use of FIDO in iframes.

Our company has recently encountered some cross domain usage scenarios of FIDO, and considering the user experience and acceptable level of collaborative applications, we have to use FIDO in <iframe>. I searched for information online and couldn't find any introduction to the security issues that FIDO may encounter in iframes.

Therefore, I hope the community can guide me to consider the security issues that need to be paid attention to when using FIDO in iframes. Thank you everyone!