CS Fundamentals Trainer · JavaScript · Security

You want only https://partner.example to be able to embed your page in an iframe, in current Chrome, Firefox and Safari. Which response…

You want only `https://partner.example` to be able to embed your page in an iframe, in current Chrome, Firefox and Safari. Which response header does that?

  1. `X-Frame-Options: ALLOW-FROM https://partner.example`
  2. `Content-Security-Policy: frame-ancestors https://partner.example`
  3. `Access-Control-Allow-Origin: https://partner.example`
  4. `Cross-Origin-Opener-Policy: same-origin-allow-popups`

Difficulty: medium

Answer this question

Related questions