1 A 'frame-ancestors' CSP directive with a URL value should compare against each frame's origin rather than URL, so a nested frame with a sandboxed parent frame with allow-same-origin should be allowed due to the parent opting out of the unique origin.
3 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
6 PASS successfullyParsed is true
12 Frame: '<!--framePath //<!--frame0-->-->'
14 Testing a cross-origin child with a policy of "http://127.0.0.1:8000 http://localhost:8080" nested in a cross-origin parent.
19 Frame: '<!--framePath //<!--frame0-->/<!--frame0-->-->'
21 This is an IFrame sending a Content Security Policy header containing "frame-ancestors http://127.0.0.1:8000 http://localhost:8080".