CODEWITHSUNDEEP
cross-domain
RubbleFord
RubbleFord

Reputation: 7636

Content-Security-Policy + frame-ancestors

I'm trying to prevent my content being loaded into an IFrame, so I implemented the Content-Security-Policy header:

Response.AddHeader("Content-Security-Policy", "frame-ancestors *.twitter.com");

On purpose to test in various browsers I set it to twitter, in the hope when I framed my content it would break.

However I get the following warning in chrome yet the content is still shown.

Refused to display 'http://corsupport.azurewebsites.net/sandbox in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors *.twitter.com".

Fairly new to this policy so any advice would be great.

I've successfully implemented

Response.AddHeader("Access-Control-Allow-Origin", 'http:localhost:61021');

Upvotes: 4

Views: 8256

Answers (1)

RubbleFord
RubbleFord

Reputation: 7636

It's actually a chrome bug which should now be fixed in the dev channel.

https://code.google.com/p/chromium/issues/detail?can=2&start=0&num=100&q=&colspec=ID%20Pri%20M%20Iteration%20ReleaseBlock%20Cr%20Status%20Owner%20Summary%20OS%20Modified&groupby=&sort=&id=129139

Upvotes: 2

Related Questions