* [x] Pass data into the iFrame (e.g. a scoped authentication token, Nextcloud fileID(s), ...)
* [x] iFrame content knows that it is opened as an integrating iFrame and adjust and simplify the layout
* [x] Pass values back to the integrating page (e.g. work package ID after integration, or cancel event, or error)
* Begin of the insertion[x]End of the insertion Begin of the deletion [ ]End of the deletion What CSP amendments are needed for both parties?
* Begin of the insertion[x]End of the insertion Begin of the deletion [ ]End of the deletion Maybe: Ensuring that the user session within the iFrame belongs to a specific user. Ask for login otherwise.

Out of scope:

* Limiting the iFrame to a separate, limited, scoped session