Iframe embed, sandboxed

A customer hardens the embed with sandbox="allow-scripts allow-same-origin". Playback works. Sign-in breaks the moment it needs a popup — and this is the support ticket you will get.

Player runs on	`control.jefflowery.dev` — third-party to this page
Sandbox	`allow-scripts allow-same-origin` — no `allow-popups`
Sign-in transport	iframe only; escalation to a popup is impossible
This page can read the viewer id	no

The markup

<iframe
  src="https://control.jefflowery.dev/webplayer/video?identifyViewer=required&id=…&type=event"
  sandbox="allow-scripts allow-same-origin"
  allow="autoplay; fullscreen"
  title="Resi player"></iframe>

Expected

In Chrome, where the in-frame storage probe passes, sign-in completes normally. The sandbox costs nothing until a popup is needed.
In Safari, or anywhere the probe fails, “Continue in a new window” appears and does nothing: sandbox flags are inherited, and without allow-popups the window.open is dropped.
That is the whole failure: a working button that silently opens nothing. Nothing in the player can detect or route around it.
Compare with the next case, which is the same hardening done correctly.

Messages reaching this page

Unchanged by the sandbox — message delivery is not what a sandbox restricts.

include same-origin messages (browser extensions)

nothing yet