P0 checks 16 and 17

Open this page twice: once signed out of Cloudflare Access (a private window), once signed in (open p0-a and p0-b first and log in). Screenshot the whole page each time.

Check 16 · Access login inside an iframe

The frame below shows https://p0-a.dibiasi.network/frame. It reads SIGNED-IN CONTENT only if Access let it load inside a frame.

Waiting for a message from the frame…

Check 17 · Calls to an Access-protected origin

1. Credentialed fetch from this page to https://p0-b.dibiasi.network/echo:

running…

2. Form POST to the same origin (opens a new tab; screenshot it too):

3. Top-level visit: open https://p0-b.dibiasi.network/echo (screenshot it).