title: X-Frame-Options and Content-Security-Policy for frames in Firefox
body: <p><a href="http://www.w3.org/TR/CSP11/#frame-ancestors-and-frame-options">Content Security Policy specification says</a></p>
  
  <blockquote>
    <p>The frame-ancestors directive obsoletes the X-Frame-Options header. If a resource has both policies, the frame-ancestors policy SHOULD be enforced and the X-Frame-Options policy SHOULD be ignored.</p>
  </blockquote>
  
  <p>So from my understanding if both <code>Content-Security-Policy</code> and <code>X-Frame-Options</code> headers are present, then <code>X-Frame-Options</code> should be ignored. </p>
  
  <p>I have a web app with both headers, and looks like Firefox 38 is ignores <code>Content-Security-Policy</code> header and uses <code>X-Frame-Options</code> header instead.</p>
  
  <p>My sample headers are:</p>
  
  <pre><code>Content-Security-Policy:frame-ancestors 'self' local.com *.local.com 
  X-Frame-Options:Allow-From http://local.com
  </code></pre>
  
  <p>I want that my frame should be accessed from local.com and all subdomains. Local.com is just example. If <code>X-Frame-Options</code> header is present, then it allows just <a href="http://local.com">http://local.com</a>, but if i remove it, then Firefox uses <code>Content-Security-Policy</code> header and works fine for domain and subdomains.</p>
  
  <p>Does it mean that Firefox isn't implementing this part? Or it's just too new specification and Firefox doesn't implement it yet? Is there any other way to force <code>Content-Security-Policy</code> header usage?</p>
  
  <p>I know that Chrome works fine with <code>Content-Security-Policy</code> and IE can work just with <code>X-Frame-Options</code>, but looks like i can't combine both headers, as Firefox works not in right way.</p>
  
  <p>One possible way is to sent <code>X-Frame-Options</code> just for IE, and <code>Content-Security-Policy</code> for all other, but is there a better way?</p>
  
  <p>Thanks!</p>