title: Iframe security headers seems to be not working with chrome
body: <p>I am trying to create a widget where it should be able to reuse as iframe on any other website. it works perfectly on same domain. I tried to use it on different domain.</p>
  <p>my iframe code is below,</p>
  <pre><code>&lt;iframe id=&quot;serviceFrameSend&quot; src=&quot;https://cyberglo.com/dyacon/dyaconlive/websiteWidget.php?pid=811addd060d7ae73429a831acae7365c&amp;amp;size=large&quot; width=&quot;1000&quot; height=&quot;1000&quot; frameborder=&quot;0&quot;&gt;&lt;/iframe&gt;
  </code></pre>
  <p>As I said above when I use this on different domain only part of widget is rendering, it has some Ajax request where it load the bottom part of data. when iframe is loaded on different domain that part isn't working.</p>
  <p><em><strong>But surprisingly its working perfectly on Firefox</strong></em> even on different domain. but no luck with chrome and safari.</p>
  <p>Maybe its due the doctype or &quot;Content-Security-Policy&quot;, I tried everything without any luck.</p>
  <p>here is my header file</p>
  <pre><code>&lt;?php header(&quot;Access-Control-Allow-Origin: *&quot;);
  include_once 'version.php';
  ?&gt;
  &lt;!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 4.01//EN&quot;
  &quot;http://www.w3.org/TR/html4/strict.dtd&quot;&gt;
  &lt;html lang=&quot;en&quot;&gt;
  &lt;head&gt;
      &lt;meta  charset=&quot;utf-8&quot; name=&quot;viewport&quot; content=&quot;width=400, initial-scale=1&quot;&gt;
      &lt;meta http-equiv=&quot;Content-Security-Policy&quot; content=&quot; default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';&quot;&gt;
      &lt;!-- responsive meta tag --&gt;
      &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width,initial-scale=1.0&quot;&gt;
      &lt;title&gt;Dyacon Weather Stations&lt;/title&gt;
          &lt;script src=&quot;js/jquery-3.2.1.js&quot;&gt;&lt;/script&gt;
          &lt;script&gt; var sid = &lt;?php echo $stationid;?&gt;; var globals = {};&lt;/script&gt;
          &lt;link rel=&quot;stylesheet&quot; href=&quot;https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css&quot; integrity=&quot;sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh&quot; crossorigin=&quot;anonymous&quot;&gt;
          &lt;link rel=&quot;stylesheet&quot; href=&quot;css/style.css&quot; type=&quot;text/css&quot;&gt;
          &lt;link rel=&quot;stylesheet&quot; href=&quot;css/jquery-ui.min.css&quot; type=&quot;text/css&quot;&gt;
          &lt;link rel=&quot;stylesheet&quot; href=&quot;css/jquery-ui.structure.min.css&quot; type=&quot;text/css&quot;&gt;
          &lt;link rel=&quot;stylesheet&quot; href=&quot;css/jquery-ui.theme.min.css&quot; type=&quot;text/css&quot;&gt;
  </code></pre>
  <p>I have added iframe on different domain for texting here</p>
  <pre><code>https://noblewebdesign.com/dyacon/widgetTest.php
  </code></pre>
  <p>Your help is really appreciated.</p>