Summary Enable Marketplace Apps to securely share the authenticated SSO/session token with their own trusted Custom Menu Link iframe. This would allow developers to build seamless multi-page applications while preserving the existing security model. Problem Currently, window.exposeSessionDetails() is intended to provide an encrypted user context that can be sent to the application's backend for server-side validation. However, many Marketplace Apps consist of multiple entry points, such as: Marketplace App pages Custom Menu Links Embedded iFrames Additional application modules These components often belong to the same application and backend, but there is no supported mechanism to securely pass the authenticated session between them. As a result, developers must implement custom authentication flows, require users to log in again, or expose unnecessary identifiers to establish a session. Proposed Solution Allow Marketplace Apps to securely pass the encrypted SSO/session payload (or a short-lived signed token) to a trusted Custom Menu Link iframe that belongs to the same Marketplace App. The flow would be: The Marketplace App obtains the encrypted session payload using window.exposeSessionDetails(). The payload is securely forwarded to the application's backend for validation. After successful validation, the backend issues a short-lived application session or signed token. The validated session can then be securely shared with the application's Custom Menu Link iframe. The iframe uses this token to authenticate with the same backend without requiring the user to log in again. Security Considerations Only allow token sharing between components registered under the same Marketplace App. Validate the destination origin against the app's registered domains. Use short-lived, signed, single-use tokens. Require all validation to occur on the backend. Prevent token sharing with third-party or unregistered domains. Benefits Provides a seamless SSO experience across Marketplace App pages and Custom Menu Links. Eliminates duplicate authentication flows and repeated logins. Reduces the need to transmit company IDs, user IDs, or other identifiers solely for authentication. Encourages developers to follow secure, backend-validated authentication patterns. Enables richer, multi-page Marketplace applications while maintaining platform security. Example Use Cases Opening a full-screen dashboard from a Marketplace App. Launching an advanced admin portal from a Custom Menu Link. Sharing authentication across multiple application modules. Supporting secure embedded experiences without requiring additional user authentication. Building enterprise applications that span multiple trusted interfaces while maintaining a single authenticated session.
