{
  "synthetic": true,
  "execution": "Teaching record only; no live integration tested",
  "slug": "embedded-login-cookie-diagnosis",
  "group": "embed",
  "title": [
    "Diagnose an embedded login before changing cookie policy",
    "嵌入登录失效，先诊断再谈Cookie策略"
  ],
  "intro": [
    "A customer signs in successfully in a provider tab but repeatedly sees the login screen inside a business website. Commission a context-by-context diagnosis before accepting instructions to disable browser privacy controls or weaken cookies.",
    "客户在供应商独立标签能登录，在企业网站嵌入框里却反复回到登录页。应先按上下文诊断，不能直接接受关闭浏览器隐私控制或削弱Cookie的建议。"
  ],
  "facts": [
    [
      "MDN explains that SameSite controls cross-site cookie sending and that SameSite=None requires Secure. Other browser policies can still restrict third-party cookies.",
      "MDN说明SameSite控制跨站发送，SameSite=None需要Secure；浏览器其他策略仍可能限制第三方Cookie。",
      "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value"
    ]
  ],
  "columns": [
    [
      "Synthetic context",
      "Observed evidence",
      "Next decision"
    ],
    [
      "合成上下文",
      "观察依据",
      "下一决定"
    ]
  ],
  "example": [
    [
      [
        "Provider top-level HTTPS tab",
        "Session cookie sent; login works",
        "Record working reference context"
      ],
      [
        "供应商独立HTTPS标签",
        "会话Cookie被发送，登录正常",
        "记录正常参照上下文"
      ]
    ],
    [
      [
        "Cross-site iframe; cookie Lax",
        "Cookie not attached in this subresource context",
        "Candidate SameSite/context cause; not proven yet"
      ],
      [
        "跨站iframe；Cookie为Lax",
        "该子资源上下文未带Cookie",
        "候选原因是策略与上下文，尚非已证实"
      ]
    ],
    [
      [
        "Iframe; None+Secure",
        "Browser blocks third-party storage",
        "Attribute change alone insufficient"
      ],
      [
        "iframe；None与Secure都有",
        "浏览器仍阻止第三方存储",
        "仅改属性不够"
      ]
    ],
    [
      [
        "Approved separate-tab fallback",
        "User logs in without privacy bypass",
        "Assess supported vendor flow"
      ],
      [
        "获批独立标签回退",
        "无须绕过隐私控制即可登录",
        "评估供应商支持流程"
      ]
    ]
  ],
  "steps": [
    [
      "Record top-level site, embedded origin, HTTPS, cookie attributes and browser version/settings. Inspect only authorised redacted test sessions; never copy session values into a support ticket.",
      "记录顶层站、嵌入来源、HTTPS、Cookie属性及浏览器版本设置；仅查获准脱敏测试会话，不能把会话值复制进工单。"
    ],
    [
      "Compare direct and embedded navigation with the same test account. Distinguish cookie rejection from authentication failure, iframe sandbox restrictions and vendor embedding support.",
      "同一测试账户比较独立与嵌入导航，区分Cookie拒绝、身份失败、沙箱限制和供应商是否支持嵌入。"
    ],
    [
      "Ask the vendor for its supported sign-in and fallback design. Security/privacy staff approve any policy proposal separately; keep a user-accessible route when embedding is unavailable.",
      "向供应商索取受支持登录及回退设计，策略建议另由安全与隐私负责人批准；嵌入不可用时仍留可访问路径。"
    ]
  ],
  "result": [
    "The matrix avoids a one-line “set SameSite=None” fix. It preserves both the symptom and the missing evidence. A working standalone login narrows the investigation but does not prove which browser control caused the failure.",
    "矩阵避免一句“改成SameSite=None”就算修复，既保留症状也保留未知。独立登录正常能缩小调查范围，但不能证明具体由哪项浏览器控制引起。"
  ],
  "accept": [
    "Require reproduced context differences, a vendor-supported solution and a working fallback on the supported browser set. Do not accept disabling third-party protections as the customer journey.",
    "须复现上下文差异，取得供应商支持方案并验收各浏览器回退；不能要求客户关闭第三方保护才能使用。"
  ],
  "limit": [
    "No login, cookie mutation or security change was executed. This does not prescribe a universal authentication architecture or a legal consent basis.",
    "没有执行登录、修改Cookie或安全设置，也不规定通用身份架构或法律同意依据。"
  ]
}