1. Same-Origin iFrame (Legitimate Login Form)

This iframe is served from the same origin as this page.

2. Cross-Origin iFrame (Simulated 3rd-party)

This iframe simulates a login form from a different origin.