title: IE SEC7111 HTTPS security is compromised by http:// with Angular 6
body: <p>I know this is a question already discussed but following various solutions my problem is still present! I've a web app developed in Angular 6, let's call it 'ExternalApp', containing an IFrame in which show pages contained in another app, let's call it 'InternalApp'. Opening an InternalApp page on Chrome and Firefox I've no problem, it's correctly showed, but on IE 11 I've this error in console:</p>
  
  <pre><code>SEC7111: HTTPS security is compromised by https://internalAppPage
  </code></pre>
  
  <p>I tried to set response header on InternalApp in this way:</p>
  
  <pre><code>response.setHeader("X-Frame-Options", "allow-from https://internalAppPage");
  response.addHeader("Content-Security-Policy", "frame-ancestors https://internalAppPage");
  </code></pre>
  
  <p>I understood X-Frame-Options is overrided by Content-Security-Policy on Chrome and Firefox. Instead, on IE Content-Security-Policy isn't compatible, so X-Frame-Options is valid. 
  My question is: is it right to set header in InternalApp? Or is ExternalApp responsible to allow url to shwn in IFrame?</p>
  
  <p>Many thanks for your suggestions.</p>