How does Content-Security-Policy work with X-Frame-Options?

Question

Does Content-Security-Policy ignore X-Frame-Options, returned by a server, or is X-Frame-Options still primary?

Assuming that I ha

Answer 1

None of your hypotheses are universally true.

• Chrome ignores X-Frame-Options.
• Safari 9 and below ignore CSP frame-ancestors.
• Safari 10-12 respect the CSP frame-ancestors directive, but prioritize X-Frame-Options if both are specified.