FlightBridge iframe sandbox

1 · Configure

Page

Resolved configuration

Override any value without editing a file: localStorage['flightbridge.sandbox.config'] = JSON.stringify({ webUrl: '…' }), then reload. The server takes FB_* env vars.

2 · The URL

—

3 · The frame

sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation" — over-tight sandboxing is a classic cause of a blank third-party frame. Edit the attribute in index.html to bisect.

FlightBridge's hotel search paginates only when the parent posts 'scrollEvent' into the child. It is the one part of the contract that fails silently — the list simply stops growing — so it gets its own button. The harness also sends it automatically on near-bottom scroll.

The frame is empty or shows an error. The likely causes, in order:

FlightBridge has not been given our auth-callback URL yet. Their server must be able to call /flightbridge/auth to resolve the token. Until then every page answers “You are not authorized to perform this action.” — which is exactly what returns for a request with no valid token. This is the expected state today. Credential #3; see TUNNEL.md.
The callback was reached but rejected the token. Check the event log for a FB CALLED US entry. If it says REJECTED, the token was unknown, expired, or already spent — tokens are single-use, so a plain frame reload always fails. Mint a fresh one.
The callback was reached but we answered the wrong shape. The log records the raw request; compare what they sent against what serve.mjs extracted. Credential #4.
Framing was blocked. The tell is a CSP error in the console. Their frame-ancestors allows localhost and localhost:*, but both are written without a scheme, and a scheme-less CSP source inherits the scheme of the page that sent the policy — https://test.flightbridge.com. So those entries mean https://localhost only: browse this harness at https://localhost:4478, not over plain HTTP. (Their list spells http://localhost:3030/ out in full, which is the same lesson.) It would also bite on a tunnel URL or on dev-my.magellanjets.com — neither is in the list, and *.ngrok.io does not cover an *.ngrok-free.dev domain. The check is against the origin of the page doing the framing, so a tunnel used only for the callback never enters into it. Credential #5.
Third-party cookies were blocked. FlightBridge sets SameSite=None; Secure and ships its own “Enable Cookie Permissions” page for this, which needs a user gesture in a new tab on Safari. If you land on that page, follow it once. Credential #6.

Full detail for each: ../CREDENTIALS-NEEDED.md.

4 · Event log

Browser events interleaved with what the server saw. When FlightBridge calls the callback this shows exactly what they sent — which is how we settle the open question of the callback's real request shape.