title: How to fix Safari ignoring Content-Security-Policy when X-Frame-Options are specified on Apache?
body: <p>Related to <a href="https://stackoverflow.com/questions/40373771/how-does-content-security-policy-work-with-x-frame-options">this question</a></p>
  
  <p>I was struggling with my iframe from another domain not being loaded properly on Safari and did not know what to do. Problem is that Safari 12 as of January 2019 still prioritizes <code>X-Frame-Options</code> over <code>Content-Security-Policy</code>.</p>
  
  <p>I had the following config in .htaccess:</p>
  
  <pre><code>Header always append X-Frame-Options SAMEORIGIN
  Header always append Content-Security-Policy "frame-ancestors 'self' *.master-domain.com *.alternative-domain.com"
  </code></pre>
  
  <p>and while this worked perfectly in Firefox, Chrome and even Edge (all just ignore the now deprecated <code>X-Frame-Options</code> when feature richer <code>Content-Security-Policy</code> is sent), Safari for some reason will choose to prioritise the old X-Frame-Options. Moreover, Safari will itself consider default <code>X-Frame-Options: DENY</code> , not allowing all like other browsers. This makes it virtually impossible to make an iframe loadable in Safari across multiple domains.</p>