I have a SaaS application that offers some basic white-labelling functionality related to CSS, company logos etc. However, one client now wants to white-label the application with their own URL so that they can then resell it to their own customers.The way that they have chosen to implement this is by having a single page on their own webserver that uses HTML 4 frames (not iframes) to host our site. This works fine for Chrome, Firefox, Safari and newer versions of IE, but breaks badly for older versions of IE (particularly IE8) when running in a locked-down corporate environment. This is because the entire application requires user authentication, which in our environment (IIS/ASP.NET) means the use of cookies; and with sites that have not been explicitly trusted by locked-down IE8, the cookie domain not matching the browser's URL causes the cookie to be rejected, so users can not sign in to our application.We can also be sure that asking clients of our clients to change their security policies so that they can access our application is also a non-starter, as is asking them to switch to another browser!Does anyone have experience of running secure white-labelled sites in this or similar ways? Short of setting up separate webservers with new URLs and SSL certificates, with ASP.NET's cookieless session tracking enabled, I'm not sure what else I can try.
White labelling with frames and IE
web hosting;web development;security