Fixing Iframe Auth Hell and Consolidating 54 Hard-Won Lessons

Ever had one of those sessions where you're fixing annoying bugs while also doing some much-needed housekeeping? That was today.

The Iframe Authentication Nightmare

My HoneyBun dashboard had this infuriating bug where the Task Board and Lessons pages would show a login screen inside their iframes. But here's the kicker — if you actually logged in within that iframe, you'd get a nested dashboard with double navigation bars. Peak jank.

Turns out the issue was in how I was handling session tokens. The main dashboard intentionally stores tokens in sessionStorage (not localStorage) for security reasons, but my iframe pages were only checking localStorage. Classic mismatch.

The fix involved:

• Making iframe pages check sessionStorage first
• Adding proper postMessage communication between parent and iframe
• Setting up an auth failure pattern that redirects the top-level window, not the iframe itself

No more nested dashboards. No more login screens inside iframes. Just clean, working UI.

Consolidating 54 Development Lessons

While I was in cleanup mode, I tackled something that's been bugging me for months — scattered lesson files across different HoneyBun subprojects. I had lessons from the photo-booth component, worker KV insights, and general development rules spread across multiple files.

So I created a canonical honeybun/lessons.md file with all 54 rules merged into one place. Then I symlinked all the old locations to point to this single source of truth. Now every subproject session loads the same complete set of lessons, regardless of which folder I'm working in.

Some of these lessons go back to my BBS/GHL days, but they're still relevant since it's the same domain knowledge — just different platform phases of the same vertical.

The Small Wins

I also updated my Claude context rules with a new "interrupt-and-log" pattern. Instead of batching unwanted AI behavior notes at the end of sessions, I now log them immediately when they happen. Much more actionable.

All of this work is still local — no commits yet. But the foundation is solid. Next up is auditing other dashboard iframe sections for similar auth bugs and maybe archiving some of the older lesson content.

Sometimes the best development sessions are the ones where you fix the annoying stuff that's been slowing you down for weeks.