為了改善您的使用體驗，本網站正在進行維護，部分功能暫時無法使用。若本站的文件無法解決您的問題，想要向社群發問的話，請到 Twitter 上的 @FirefoxSupport 或 Reddit 上的 /r/firefox 發問，我們的社群成員將很快會回覆您的疑問。

Avatar for Username

搜尋 Mozilla 技術支援網站

防止技術支援詐騙。我們絕對不會要求您撥打電話或發送簡訊，或是提供個人資訊。請用「回報濫用」功能回報可疑的行為。

了解更多

此討論串已被封存。 如果您有需要幫助，請新增一個新問題

Content-Security-Policy: frame-ancestors doesn't work

  • 1 回覆
  • 1 有這個問題
  • 1 次檢視
  • 最近回覆由 vinh.vu

vinh.vu
vinh.vu
more options

As mentioned here https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors, CSP: frame-ancestors is supported from Firefox 33. However, it seems doesn't work.

I am trying to embed a 3-party site into our page using an iframe. The 3-party site did whitelist us using these headers - Content-Security-Policy: frame-ancestors 'self' https://*.ourdomain.com - X-Frame-Options: SAMEORIGIN

It works fine on Chrome, but not Firefox. I am using Firefox 79.

Is there anything wrong with our headers?

Thank you!

As mentioned here https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors, CSP: frame-ancestors is supported from Firefox 33. However, it seems doesn't work. I am trying to embed a 3-party site into our page using an iframe. The 3-party site did whitelist us using these headers - Content-Security-Policy: frame-ancestors 'self' https://*.ourdomain.com - X-Frame-Options: SAMEORIGIN It works fine on Chrome, but not Firefox. I am using Firefox 79. Is there anything wrong with our headers? Thank you!

被選擇的解決方法

There is a bug with nested iframe https://bugzilla.mozilla.org/show_bug.cgi?id=1404438

從原來的回覆中察看解決方案 👍 0

所有回覆 (1)

vinh.vu
vinh.vu 提出問題者
more options

選擇的解決方法

There is a bug with nested iframe https://bugzilla.mozilla.org/show_bug.cgi?id=1404438