They're on another domain they own, but they are on another domain (cdpn.io) and the cross-origin concern does apply. They do that because they have auth cookie

They're on another domain they own, but they are on another domain (cdpn.io) and the cross-origin concern does apply. They do that because they have auth cookies on codepen.io and don't want them exposed to the iframe. See these tweets by their cofounder: https://twitter.com/chriscoyier/status/1422940724295786503?s=20 https://twitter.com/chriscoyier/status/1422940724295786503?s... and https://twitter.com/chriscoyier/status/1420033471376920578?s=20 https://twitter.com/chriscoyier/status/1420033471376920578?s...