[g-b-r]

Keep in mind that urls end up in logs, that might well not be so well protected

[bob1029]

In our case this is fine. The URL doesn't pass any claims. It is opaque client state bound to a specific identity which is validated by other means.

[EE84M3i]

Particularly if you use cdns, tracing, analytics, etc.

Also, IIRC a parent frame can retrieve a child frame's current URL no matter what.