CodePen Embed iframe ↔ Host Website postMessage, sandbox and CSP interoperability
Goal is to embed a CodePen Pen via iframe on a host website that enforces a strict Content-Security-Policy and Cross-Origin-Opener-Policy. The integration relies on cross-origin postMessage for auto-height resize and runtime theme changes, and on correct sandbox and frame-ancestors settings for the embed to load. Uncertainty exists around which embed URL for