If an iframe doesn’t allow same-origin, then requests to servers and postMessage to other windows are treated as cross-origin.

But what about interaction with the browser? Say an iframe is loaded from twitter.com without allowing same-origin

Will webauthn work with it, using twitter.com credentials?

How about PaymentRequest?

How about Password autofills?

Would like the answers to specify browsers (eg Chrome, iOS Safari etc.) I understand that cross-origin iframes cannot create credentials in browsers yet (despite the latest webauthn spec) and I am not asking about that.