I have an Angular application protected by OAuth2 authentication. Part of the authentication token is stored in a cookie.

This Angular application includes an iframe that represents another nested Angular application.

The two applications are on different domains.

Now the requirement is to pass the authentication token, in addition to the cookie, to the application in the iframe without exposing the two apps to too many security risks.

P.S. I know that we can use the postMessage API, but that will be my last resort solution