title: How to allow all frame ancestors with CSP header?
body: <p>I have a web app which I want to display in an iframe in web apps with different domains. Since I have added a content-security-policy header my app refuses to display in iframe. I saw that i need to add frame-ancestors options but all the examples I see are using specific domains. How can I allow it for all domains? Is &quot;frame ancestors *;&quot; enough? Thanks!</p>