Content Security Policy set to frame-ancestors self on live

Matthew Butler asked on October 31, 2022 13:00

The page editor is setup and works in dev, but on live when requesting the page in the editor domain.com/cmsctx/pm/... adds the header Content Security Policy set to frame-ancestors self.

But on dev its set up frame-ancestors www.domain.com admin.domain.com.

Any idea what drives this setting and why it would differ in live?

Recent Answers


Dmitry Bastron answered on October 31, 2022 19:07

Hi Matthew,

Do you have any administration domain aliases set maybe? Could those be different on dev vs prod?

0 votesVote for this answer Mark as a Correct answer

Matthew Butler answered on November 1, 2022 10:23

No domain aliases empty on both.

The only difference really is the prod is behind Azure App Gateway.

So I've solved by getting it to add the headers on response. But ideally would like to resolve properly.

0 votesVote for this answer Mark as a Correct answer

Jeroen Fürst answered on November 22, 2022 11:15

Hi Matthew,

We had similar problems using Azure Front Door. Leaving the "Backend host header" empty fixed it for us.

Cheers, Jeroen

0 votesVote for this answer Mark as a Correct answer

Matthew Butler answered on November 23, 2022 10:28

Thank you for your response Jeroen, but I need the backend host headers to correctly route to app service

0 votesVote for this answer Mark as a Correct answer

   Please, sign in to be able to submit a new answer.