title: Content Security Policy for iframe (frame-ancestors) filled in but shows up as 'none'
body: <p>Im trying to implement Content-Security-Policy &quot;frame-ancestors&quot; on nginx. I have set the header as</p>
  <p><strong>add_header Content-Security-Policy &quot;frame-ancestors 'https://6f4f-213-3-38-224.ngrok.io';&quot;;</strong></p>
  <p>But when I try to add the iframe from this site, Chrome displays the following error:</p>
  <p><strong>Refused to frame 'https://sandbox.byproperti.ch/' because an ancestor violates the following Content Security Policy directive: &quot;frame-ancestors 'none'&quot;.</strong></p>
  <p>following is the server block form nginx:</p>
  <pre><code>server{
  listen 80;
  listen [::]:80;
  
  
          location ~ /\. {
                  deny all;
                  access_log off;
                  log_not_found off;
  
          }
          location ~ /log.csv {
                  deny all;
                  access_log off;
                  log_not_found off;
          }
  root /var/www/sandbox.byproperti.ch/doc/html;
  index index.html index.html;
  
  server_name xx.xxx.xxx.xx;
          location /doc {
                  try_files $uri/ @doc;
  }
  
  location @doc {
          rewrite ^/(doc|keyword)/? /index.html?_route_=$1&amp;$args last;
  }
  listen 443 ssl;
  add_header Content-Security-Policy &quot;frame-ancestors 'https://6f4f-213-3-38-224.ngrok.io';&quot;;
  ssl_certificate /etc/letsencrypt/live/sandbox.byproperti.ch/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/sandbox.byproperti.ch/privkey.pem;
  
  
  }
  </code></pre>