How to set CSP for frame-ancestors?

PHPMaker General Discussion (PHPMaker)
1

v2026
thought all was working until i realized i had enabled a CSP remover plugin during testing....

i am trying to allow iframes:

    Config()->append("CSP.frame-ancestors.allow", "http://mydomain.com");
    Config()->append("CSP.frame-ancestors.self", "http://mydomain.com");

or whatever will allow iframes.

as well as in ht .htaccess as:

<IfModule mod_headers.c>
    Header always append Content-Security-Policy "frame-ancestors 'self' https://mydomain.com;"
</IfModule>

as well as in config.php

        'frame-ancestors' => [
            'self' => true,
            'allow' => [
                'https://mydomain.com', 
            ],
        ],

it continues to insist that: "violates the following Content Security Policy directive: "frame-ancestors 'none'""

are iframes now allowed to be used on the internet any longer?

but for some reason works in Edge.

thanks
JS

2

The CSP configuration default is only: (check the generated config.php)

        'frame-ancestors' => [
            'self' => true,
        ],

There is no "frame-ancestors 'none' sent by PHP, you may want to double check your web server configuration, check if it adds that by default.

3

looks like it was my haproxy server causing the grief.

added this to the backend config of the app:

http-response set-header Content-Security-Policy "frame-ancestors 'self' https://domain.com;"

not sure why it would block requests as there are no other CSP entries in the file, and all the other CSP entries in phpM are working via the app entries.. go figure

thanks,
JS