CSP frame-ancestors
Who may embed your page in a frame. The modern replacement for X-Frame-Options.
- Falls back to
- nothing — must be set explicitly
- Group
- Document and navigation directives
Detail
Does not fall back to default-src. Browsers that support it ignore X-Frame-Options entirely, so when both are set this is the one that applies. 'none' is the equivalent of DENY; 'self' of SAMEORIGIN. Unlike X-Frame-Options it accepts a list of origins, which is why ALLOW-FROM was never needed.
Example
frame-ancestors 'none'