The HTTP Content-Security-Policy
(CSP) frame-ancestors
directive specifies valid parents that may embed a page using <frame>
, <iframe>
, <object>
, <embed>
, or <applet>
.
Setting this directive to 'none'
is similar to X-Frame-Options
: DENY
(which is also supported in older browers).
CSP version | 2 |
---|---|
Directive type | Navigation directive |
default-src fallback |
No. Not setting this allows anything. |
This directive is not supported in the <meta> element or by the Content-Security-policy-Report-Only header field. |
Syntax
One or more sources can be set for the frame-ancestors
policy:
Content-Security-Policy: frame-ancestors <source>; Content-Security-Policy: frame-ancestors <source> <source>;
Sources
<source> can be one of the following:
The frame-ancestors
directive’s syntax is similar to a source list of other directives (e.g. default-src
, but doesn't allow 'unsafe-eval'
or 'unsafe-inline'
for example. It will also not fall back to a default-src
setting. Only the sources listed below are allowed:
- <host-source>
- Internet hosts by name or IP address, as well as an optional URL scheme and/or port number. The site's address may include an optional leading wildcard (the asterisk character,
'*'
), and you may use a wildcard (again,'*'
) as the port number, indicating that all legal ports are valid for the source.
Examples:http://*.example.com
: Matches all attempts to load from any subdomain of example.com using thehttp:
URL scheme.mail.example.com:443
: Matches all attempts to access port 443 on mail.example.com.https://store.example.com
: Matches all attempts to access store.example.com usinghttps:
.
- <scheme-source>
- A schema such as 'http:' or 'https:'. The colon is required. You can also specify data schemas (not recommended).
- '
data:
' Allowsdata:
URIs to be used as a content source. This is insecure; an attacker can also inject arbitrary data: URIs. Use this sparingly and definitely not for scripts. 'mediastream:'
Allowsmediastream:
URIs to be used as a content source.'blob:'
Allowsblob:
URIs to be used as a content source.'filesystem:'
Allowsfilesystem:
URIs to be used as a content source.
- '
'self'
- Refers to the origin from which the protected document is being served, including the same URL scheme and port number. You must include the single quotes. Some browsers specifically exclude
blob
andfilesystem
from source directives. Sites needing to allow these content types can specify them using the Data attribute. 'none'
- Refers to the empty set; that is, no URLs match. The single quotes are required.
Examples
Content-Security-Policy: frame-ancestors 'none';
Specifications
Specification | Status | Comment |
---|---|---|
Content Security Policy Level 3 The definition of 'frame-ancestors' in that specification. |
Editor's Draft | No changes. |
Content Security Policy Level 2 The definition of 'frame-ancestors' in that specification. |
Recommendation | Initial definition. |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Feature | Chrome | Firefox | Edge | Internet Explorer | Opera | Safari |
---|---|---|---|---|---|---|
Basic Support | 40 | 33.0 | (No) | (No) | 26 | 10 |
Feature | Android | Chrome for Android | Edge mobile | Firefox for Android | IE mobile | Opera Android | iOS Safari |
---|---|---|---|---|---|---|---|
Basic Support | ? | (Yes) | (No) | 33.0 | (No) | ? | 9.3 |