This feature is well established and works across many devices and browser versions. It’s been available across browsers since August 2016.
The HTTP Content-Security-Policy (CSP)
frame-src directive specifies valid sources for nested
browsing contexts loading using elements such as and
| Specification |
|---|
| Content Security Policy Level 3 # directive-frame-src |
Content-Security-Policy\n"}},{"type":"specifications","value":{"id":"specifications","title":"Specifications","isH3":false,"specifications":[{"bcdSpecificationURL":"https://w3c.github.io/webappsec-csp/#directive-frame-src","title":"Content Security Policy Level 3"}],"query":"http.headers.Content-Security-Policy.frame-src"}},{"type":"browser_compatibility","value":{"id":"browser_compatibility","title":"Browser compatibility","isH3":false,"query":"http.headers.Content-Security-Policy.frame-src"}},{"type":"prose","value":{"id":"see_also","title":"See also","isH3":false,"content":"