DASH (dash.bramwell.io) — cross-site embedder

Embeds https://app.bramwell.dev/ (different registrable domain → cross-site). The frame's log messages are mirrored below via postMessage.

Manual checks

• Test 0: iframe request shows Sec-Fetch-Site: cross-site in devtools.
• C: iframe below shows the bootstrap (200), never a redirect to Entra.
• C′: Sign in → Continue → ping 200 from inside the frame.
• D: Test WebSocket from inside the frame → echo (the go/no-go).
• Q3: Reload frame → does access come back silently? (Chrome/FF: yes via silent rSA; Safari: expect gesture needed.)
• B: open APP top-level → redirect gate to Entra.

Frame log