Iframe embed, sandboxed

A customer hardens the embed with sandbox="allow-scripts allow-same-origin". Playback works. Sign-in breaks the moment it needs a popup — and this is the support ticket you will get.

Player runs on	control.jefflowery.dev — third-party to this page
Sandbox	allow-scripts allow-same-origin — no allow-popups
Sign-in transport	iframe only; escalation to a popup is impossible
This page can read the viewer id	no

The markup

<iframe
  src="https://control.jefflowery.dev/webplayer/video?identifyViewer=required&id=…&type=event"
  class="resi-video-frame"
  sandbox="allow-scripts allow-same-origin"
  allow="autoplay; fullscreen"
  title="Resi player"></iframe>

Expected

• In Chrome, where the in-frame storage probe passes, sign-in completes normally. The sandbox costs nothing until a popup is needed.
• In Safari, or anywhere the probe fails, “Continue in a new window” appears and does nothing: sandbox flags are inherited, and without allow-popups the window.open is dropped.
• That is the whole failure: a working button that opens nothing. Nothing in the player can detect it — window.open returns null exactly as a blocked popup does.
• Compare with the next case, which is the same hardening done correctly.

Messages reaching this page

Every postMessage delivered to this window, newest last, with repeats collapsed. In this case:

• Nothing at all, in the normal case. There is no page.min.js here, so nobody sends PING_PLAYER and the player has nothing to answer — the parent contract is opt-in. See the page script case for what it looks like when it runs.
• Nothing after a sign-in attempt, whether it succeeded or was silently dropped. The log cannot tell you which — watch for playback, and for the popup that never appears.
• A sandbox restricts what the frame may do, not what it may post. Message delivery is unaffected.

Messages tagged [this page] come from this document’s own origin and are hidden by default. They are browser extensions: password managers, React DevTools and the like all inject content scripts that post on this page’s behalf. Nothing from the player or the sign-in page can appear under that tag.