如果我在iframe中加载另一个站点，该网站的内容安全策略标题对该站点是否被阻止会影响吗？
例如，如果我打开 www.google.com 在iframe中还有Google.com上的那些？还是Google的CSP仅影响他们试图在iFrame中加载的内容。
当然，如果Google有自己的IFRAME，则需要CSP标头来允许任何第三方内容加载。但是，在Google.com开始加载后，我的CSP标头对Google有任何影响吗？如果Google尝试将YouTube.com加载到iframe中，而我没有将youtube.com在我的CSP白名单中包含在我的CSP白名单中吗？
抱歉，如果这是一个愚蠢的问题，我正在尝试将我的头缠绕在iframe上。我想知道的是，我是否需要担心第三方的CSP设置，尤其是如果我在嵌套iframe，或者我只需要担心我的CSP策略。
我认为我要说的是：一旦我说“允许这个第三方站点加载”，我的CSP标题可以根据 CSP标头加载任何东西？
谢谢！
If I'm loading another site in an iFrame do the Content Security Policy Headers of that site have any affect on whether the site gets blocked?
e.g. if I open www.google.com in an iFrame is there any interaction between the CSP header settings on my site and the ones on google.com? Or would Google's CSP only affect what they're trying to load in the iFrame.
Of course if google had their own iFrames they'd need CSP headers to allow any 3rd party content to load. But do my CSP headers have any affect on Google's after google.com starts to load? If Google tried to load youtube.com in an iFrame and I didn't include youtube.com in my CSP whitelist would that work?
Sorry if this is a silly question, I'm trying to wrap my head around iFrames. What I'm wondering is if I need to worry about the CSP settings on the third party, especially if I'm nesting iFrames, or if I only need to worry about my CSP policy.
I think what I'm getting at is this: Once I've said "allow this 3rd party site to load" in my CSP headers can that site load whatever it wants based on their CSP headers?
Thanks!
发布评论
评论（2）
假设您有一个网站
B。允许站点B被构架。如果未设置Frame-SRC，则将Child-SRC用作后备，如果未设置该src，则将默认为SRC用作后备。如果没有一个受到限制，则所有站点都可以构架。
网站B可以设置“框架 - 符合人A”，以允许A框架A。该指令没有后备。如果未设置它，任何站点都可以框架B。如果设置了网站，则只有被列为有效源列出的站点才能将其构架。
对于框架SRC（Child-SRC，默认为SRC）的框架和框架框架 - 框架，CSP对其他站点没有影响，他们每个人都会控制自己的来源。
Let's say that you have site A framing site B. Site A must not set a framing policy that denies site B and site B must not set a policy that prevents being framed by A.
Site A can set "frame-src B" to explicitly allow site B to be framed. If frame-src is not set, child-src is used as a fallback, and if that is not set, default-src is used as a fallback. If none of them are restricted, all sites can be framed.
Site B can set "frame-ancestors A" to allow framing by A. This directive has no fallback. If it is not set, any site can frame site B. If it is set, only the sites listed as valid sources can frame it.
Apart for frame-src (child-src, default-src) for the framer and frame-ancestors for the framed, there is no impact on other sites by the CSP, they each control their own sources.
CSP标头指令对应于IFRAMES，
可以说您的网站 xyz.com 和Google的网站“ Google.com”。
网站xyz.com有自己的CSP可以控制，
相同的方案适用于Google.com（他们的CSP可以决定，他们可以在其应用程序中加载为iframe;可以将Google.com加载为iFrame）
每个HTML文档都有自己的CSP响应标头，不会干扰其主机应用程序（父帧）或其IFRAMES（子框架）。
xyz.com 的CSP仅决定谁应该加载它＆amp;除此之外
站点是否应作为框架加载。
可详细参考：
CSP Header directive corresponding to iframes ,
lets say your site xyz.com and google's site "google.com".
Site xyz.com has its own csp which can controls,
same scenario applies for google.com ( whose csp can decide, whom to be loaded as iframe inside its app & whom can load google.com as iframe )
Each html document has its own csp response header, which will not interfere with its host app (parent frame) or its iframes (child frames).
xyz.com 's CSP only decides whom should load it & whom it should load as frame, it cannot control its host frame or child frame ( they are considered as separate entities )
Apart from this another header X-FRAME-OPTIONS is also available with minimal control options to decide whether a site should load as frame or not.
For detailed reference :