This feature is well established and works across many devices and browser versions. It’s been available across browsers since April 2017.
The HTTP Content-Security-Policy (CSP)
child-src directive defines the valid sources for web workers and nested browsing
contexts loaded using elements such as and
| Specification |
|---|
| Content Security Policy Level 3 # directive-child-src |
Content-Security-Policy\n\n\n"}},{"type":"specifications","value":{"id":"specifications","title":"Specifications","isH3":false,"specifications":[{"bcdSpecificationURL":"https://w3c.github.io/webappsec-csp/#directive-child-src","title":"Content Security Policy Level 3"}],"query":"http.headers.Content-Security-Policy.child-src"}},{"type":"browser_compatibility","value":{"id":"browser_compatibility","title":"Browser compatibility","isH3":false,"query":"http.headers.Content-Security-Policy.child-src"}},{"type":"prose","value":{"id":"see_also","title":"See also","isH3":false,"content":"