Milestone 0.5. Google refuses to run its sign-in inside a frame, so the ceremony happens in a popup and the result is planted back into this frame. The question is whether it stays planted.
Partitioned cookie
not present
jra_session — SameSite=None; Secure; Partitioned. Keyed to the embedding site. The one that has to work.
Unpartitioned cookie
not present
jra_session_np — the control. A plain third-party cookie: works in Chrome today, not guaranteed under enterprise policy or Safari.
Signed in as
—
Name
—
Running in a frame
checking…
Why signing in at this URL proves nothing. A partitioned cookie is keyed to the top-level site it was set under. Set here, its partition is us; inside the Hub, the partition is googleusercontent.com. Different key, cookie withheld — by design, not by failure. The only run that counts is the one started from the Hub.