271377 2024-03-21 05:34:37 -0700 Frame-Ancestors directive not supported in Content-Security-Policy-Report-Only Mode 2024-03-28 02:35:53 -0700 1 1 1 Unclassified WebKit Frames WebKit Nightly Build Unspecified Unspecified NEW https://bugs.webkit.org/show_bug.cgi?id=251889 https://bugs.webkit.org/show_bug.cgi?id=247626 https://bugs.webkit.org/show_bug.cgi?id=207563 BrowserCompat, InRadar, WPTImpact P2 Normal --- 1 jannis.rautenstrauch webkit-unassigned cdumez karlcow mike webkit-bug-importer wilander oldest_to_newest 2022713 0 jannis.rautenstrauch 2024-03-21 05:34:37 -0700 Framing a page that sets a `Content-Security-Policy-Report-Only: frame-ancestors 'none'` header results in the following error message: "The Content Security Policy directive 'frame-ancestors' is ignored when delivered in a report-only policy." in Safari only. In Chromium and Firefox, a report is generated. The following two WPT tests already test for this behavior and it would be great for compatibility if WebKit also would report the violation here. - https://wpt.fyi/results/content-security-policy/frame-ancestors/report-only-frame.sub.html?label=master&label=experimental&aligned&q=frame-ancestors - https://wpt.fyi/results/content-security-policy/reporting/report-frame-ancestors-with-x-frame-options.sub.html?label=master&label=experimental&aligned&q=frame-ancestors 2023000 1 karlcow 2024-03-21 20:12:12 -0700 The first test http://wpt.live/content-security-policy/frame-ancestors/report-only-frame.sub.html fails with (No asserts ran) undefined is not an object (evaluating 'data[0]["body"]') only in Safari The second test fails http://wpt.live/content-security-policy/reporting/report-frame-ancestors-with-x-frame-options.sub.html fails with (No asserts ran) Safari: undefined is not an object (evaluating 'data[0]["body"]') Firefox: can't access property "body", data[0] is undefined 2023001 2 webkit-bug-importer 2024-03-21 20:12:28 -0700 <rdar://problem/125210248> 2023056 3 jannis.rautenstrauch 2024-03-22 00:41:12 -0700 The second test failing in Firefox is not due to the feature the test wants to test but due to the fact that a download is triggered in Firefox only: https://github.com/web-platform-tests/wpt/issues/45249