Invisible iframes are fantastic for sandboxing third-party code, or perhaps modularising work from another team.
Avoiding cookies in iframes is important because browsers are getting more restrictive, so security for iframes is difficult to manage. We passed a unique session token to the iframes from the owning page using postMessage(), and the two servers (we controlled both) communicated directly for authentication (avoid putting authentication into the browser since your enemy controls it completely).
I have always found trying to use iframes as a visible section of your UI is really crappy. Troubles with keyboard focus, resizing, modal dialogs, scrolling, Mobile Safari quirks, detecting loading or other failures, yada yada yada.
Avoiding cookies in iframes is important because browsers are getting more restrictive, so security for iframes is difficult to manage. We passed a unique session token to the iframes from the owning page using postMessage(), and the two servers (we controlled both) communicated directly for authentication (avoid putting authentication into the browser since your enemy controls it completely).
I have always found trying to use iframes as a visible section of your UI is really crappy. Troubles with keyboard focus, resizing, modal dialogs, scrolling, Mobile Safari quirks, detecting loading or other failures, yada yada yada.