Enterprise SSO portals (e.g. Okta-hosted login widgets) that embed the 2FA challenge step in a same-origin <iframe>.
Pattern
Outer page on this origin embeds d1-iframe-inner.html (same origin) via a standard <iframe>. The inner frame holds a strict-baseline TOTP form (same shape as A1).
Expected
Content script is injected into all frames (all_frames: true). Inner-frame autofill works; untrustedIframe check passes because the iframe URL is on the same origin as the matched cipher.
Purpose
Baseline iframe test. Cross-origin iframe variant (D2) requires a separate subdomain and is not yet built.
2FA challenge (embedded)
The form below is loaded from d1-iframe-inner.html on the same origin.