79132792

Date: 2024-10-28 09:38:41
Score: 1.5
Natty:
Report link
  1. What could be auto-generating the first director ("frame-ancestors 'self'")? IIS? Chrome>?

Please check if your application has any code that sets the header, as well as other IIS global/site-level CSP header settings.

  1. If two headers are present, would the second directive (the custom one added via IIS) be ignored.

When multiple CSP headers are present, the most-restrictive CSP directives are enforced. More details you can refer to this doc:https://w3c.github.io/webappsec-csp/#multiple-policies

  1. What can I try in order to resolve the error?

First make sure you only apply one CSP directive(based on question 2), and in this case, frame-ancestors *.otherdomain.com; should match your needs.

Reasons:
  • Blacklisted phrase (1): What could be
  • RegEx Blacklisted phrase (1.5): resolve the error?
  • Long answer (-0.5):
  • Has code block (-0.5):
  • Contains question mark (0.5):
  • Starts with a question (0.5): What
  • High reputation (-1):
Posted by: Xudong Peng