title: Content Security Policy 'frame ancestors' directive not working in <meta> element
body: <p>As part of clickjacking we are trying to add CSP headers as meta tags to our angular projects. Below is the html</p>
  
  <pre><code>&lt;!doctype html&gt;
  &lt;html lang="en"&gt;
  &lt;head&gt;
    &lt;meta http-equiv="Content-Security-Policy" content="frame-ancestors 'self'"&gt;
    &lt;meta charset="utf-8"&gt;
    &lt;title&gt;QA Eval Webapp&lt;/title&gt;
    &lt;base href="/"&gt;
  
    &lt;meta name="viewport" content="width=device-width, initial-scale=1"&gt;
    &lt;link rel="icon" type="image/x-icon" href="favicon.ico"&gt;
  &lt;/head&gt;
  &lt;body&gt;
    &lt;app-root&gt;&lt;/app-root&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>However, when we try to load the page as an iframe, it loads. We have tested in google chrome.</p>
  
  <p>To fix this, we have build the angular project, moved the files under dist to a web application, added a filter to add CSP headers to the response for every request. Below is the code</p>
  
  <pre><code>package com.web.beginner;
  
  import java.io.IOException;
  
  import javax.servlet.Filter;
  import javax.servlet.FilterChain;
  import javax.servlet.FilterConfig;
  import javax.servlet.ServletException;
  import javax.servlet.ServletRequest;
  import javax.servlet.ServletResponse;
  import javax.servlet.annotation.WebFilter;
  import javax.servlet.http.HttpServletResponse;
  
  @WebFilter(urlPatterns="/*", filterName = "cspfilter")
  public class CSPFilter implements Filter {
  
      @Override
      public void destroy() {
          // TODO Auto-generated method stub
  
      }
  
      @Override
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
          HttpServletResponse httpResponse = (HttpServletResponse) response;
          httpResponse.setHeader("Content-Security-Policy", "frame-ancestors 'self'");
          chain.doFilter(request, response);
      }
  
      @Override
      public void init(FilterConfig arg0) throws ServletException {
          // TODO Auto-generated method stub
  
      }
  
  }
  </code></pre>
  
  <p>This works.</p>
  
  <p>Why is CSP header not working when added in the meta tag? I even checked <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy" rel="noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy</a> and they mention adding CSP in the meta tag.</p>
  
  <p>I know that X-FRAME-OPTIONS do not support html meta tags. Is it the same with Content-Security-Policy as well? Or is chrome ignoring CSP in meta tag?</p>