Integrating a web app via iframe caused a surge in token requests

Oliveyoung carried out a project to embed an advertising partner office system into its existing platform via iframe as part of expanding its retail media business. With the child application having no authentication system of its own, the key challenge was securely sharing the parent application's authentication token.

Considering security and flexibility, the postMessage API was chosen as the communication method. This decision was made to avoid the security vulnerabilities of URL parameters and the constraints of Cookie's SameSite policy. However, during implementation, the team ran into difficulties with duplicate token requests occurring when multiple APIs were called simultaneously, and a chain of 401 errors that followed.

To resolve this, the following technical patterns were applied.

• Request Queueing: Only the first request performs actual processing, while the remaining requests are placed in a queue and share the result, preventing duplicate requests.
• Promise sharing pattern: When a 401 error occurs, a single Promise is shared so that multiple requests don't simultaneously attempt to refresh the token.
• Security hardening: Origin validation, Rate Limiting, and a cool-down mechanism were introduced to block infinite retry loops and security threats.