You can use webrtc p2p, check http://peerjs.com - the sever doesn’t relay anything, you can define a secret by using a common property in the iFrame to help the peers.