We have the exact same issue. Since M64, a partner integration in an iframe is completely broken. It was working fine for months prior to the M64 release.

We added the allow="microphone; camera" to the iframe, but it still doesn't work as they do a redirect to one of their subdomain before request access to the camera and microphone.

Their flow (domain edited) starts on something like authentication.example.org, then redirects on successful auth to go.example.org.

It still works on Firefox, all existing and relevant versions.

I had mentioned Firefox in my report, but it's sort of irrelevant because Firefox doesn't have the added security feature that Chrome implemented in 64.

We've solved the issue with test pages by using a header for the parent page:

Feature-Policy microphone *; camera *; speaker *

Since usermedia cannot be used:

https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/uKO1CwiY3ts
https://bugs.chromium.org/p/chromium/issues/detail?id=666765&desc=2

One could use more restrictive rules of course.

It looks like the iframe "allow" approach simply doesn't work as is. Which I guess makes sense for different domains, less sense for subdomains.

I hope this helps.

<iframe src="https://example.com/" allow="microphone;camera;speaker"> will allow those features to be used in the frame as long as the document in that frame is hosted at https://example.com. If it redirects, or allows the user to navigate to a different site, then the features will not be available.

There are a couple of ways to allow it after a redirect -- if you know that the final page which needs to call getUserMedia is, say, https://example.net/, then you can allow that origin specifically:

<iframe src="https://example.com/" allow="microphone https://example.net;camera https://example.net;speaker https://example.net">

If it *might* redirect there, and might not, you can supply both origins:

<iframe src="https://example.com/" allow="microphone https://example.com https://example.net;camera https://example.com https://example.net;speaker https://example.com https://example.net">

(As a shorthand, 'src' can be used to refer to the origin of the document named in the src attribute, so you could use

<iframe src="https://example.com/" allow="microphone 'src' https://example.net;camera 'src https://example.net;speaker 'src' https://example.net">

)

If you don't know where the frame is going to go, but want to allow access to the features in the frame, no matter where it navigates to, then you can use * to indicate 'all origins':

<iframe src="https://example.com/" allow="microphone *;camera *;speaker *">

Be aware that *any* content loaded into that frame will have access to the user's camera and microphone in that case, though. If the user can be convinced to click a link to a malicious site, then that site could gain access to those devices (hence the safer default).