So, when the user clicks the “Continue with Facebook” button, the URL from the postMessage payload executes in the proxy iframe, which leads to the execution of the JavaScript on Facebook.com.