Stand-in customer page — iframe embed of the deployed player

The customer iframes a Resi-hosted player page. Inside the frame video.html carries data-resi-body, so isInOwnFrame() is true, but window.self !== window.top — not standalone. The player and the sign-in page share the Resi origin; both are third-party to whatever host is in your address bar.

identifyViewer travels as a query param and is mapped to data-identify-viewer by standAlone() in the loader, which runs only because data-resi-body is present. The player consults the attribute only when the player profile supplies no mode of its own.

Mode id type sandbox the frame Load

Context

This page
Player origin
Relationship
Frame src

Messages reaching this page

Every cross-origin postMessage delivered to this window, with its origin. This is the leak check: the sign-in result is addressed to the player frame with an explicit targetOrigin, so nothing from the auth flow should ever appear here. A payload carrying a uid or viewerId below means someone passed '*', and every other script on a customer's page would be reading viewer identity.

Same-origin messages are hidden by default. Browser extensions inject content scripts into this page and some post on a timer — React DevTools every 500ms — and they carry this page's own origin. A leak cannot: it would arrive from the player frame, a different origin. Repeats collapse into a count.

include same-origin messages (browser extensions)

What to check

• Sign-in completes in a third-party frame. Chrome partitions the frame's storage under this page's site, which is why the flow probes storage first and escalates to a popup when it is unreachable.
• Session does not follow the viewer across customers. Sign in here, then load the same player from the other embed host. Under partitioning the Firebase session is scoped to the top-level site, so the viewer is asked again — a different firebase:authUser:<apiKey>:[DEFAULT] bucket, not a missing one.
• Sandboxing the frame breaks sign-in. Tick the box and retry: the popup escalation has nowhere to go.
• Nothing lands in the message log.

Where to serve this from

Any host except the player's own. Two Cloudflare projects already exist and each pages.dev project is its own site under the Public Suffix List, which makes them a genuine cross-site pair:

• resi-embed-a.pages.dev — customer A
• resi-embed-b.pages.dev — customer B

Locally, npx vite --port 5050 --host serves this at /iframe-embed-cf.html. That is cross-site too, but localhost is special-cased for storage and cookies in several browsers, so treat a local pass as wiring confirmation only — partitioning and ITP behaviour need the deployed hosts.