title: frame-ancestors of Content-Security-Policy is not working in Chrome, Firefox and IE
body: <p>Let's say my main java web application is running on machine one;
  <a href="http://192.168.0.1:8080/mainapp" rel="nofollow noreferrer">http://192.168.0.1:8080/mainapp</a></p>
  
  <p>Other two applications are framing my main application.<br>
  Assume other two applications are running on other machine like<br> 
  <a href="http://192.168.0.21/TrustedOne" rel="nofollow noreferrer">http://192.168.0.21/TrustedOne</a> and <a href="http://192.168.0.31/TrustedTwo" rel="nofollow noreferrer">http://192.168.0.31/TrustedTwo</a> <br>
  These two application is framing like</p>
  
  <pre><code>&lt;html&gt;
  &lt;body&gt;
    &lt;iframe src="http://192.168.0.1:8080/mainapp" width="200" height="200"&gt;
    &lt;/iframe&gt; 
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>I want to allow framing only for <a href="http://192.168.0.21/TrustedOne" rel="nofollow noreferrer">http://192.168.0.21/TrustedOne</a> and <a href="http://192.168.0.31/TrustedTwo" rel="nofollow noreferrer">http://192.168.0.31/TrustedTwo</a>.
  So I put Content-Security-Policy header in filter class at my main java application.</p>
  
  <pre><code>public void doFilter(ServletRequest request, ServletResponse response,  
  FilterChain chain) throws IOException, ServletException {  
  
      response.addHeader("Content-Security-Policy", "frame-ancestors http://192.168.0.21/TrustedOne http://192.168.0.31/TrustedTwo"); 
      chain.doFilter(request, response);
  }
  </code></pre>
  
  <p>My expecting result is that these two framing applications should get access to main application inside the iframe.</p>
  
  <p>But both of these framing applications cannot access <a href="http://192.168.0.1:8080/mainapp" rel="nofollow noreferrer">http://192.168.0.1:8080/mainapp</a> in all of the browser; Chrome, Firefox and IE. <br>All browsers blocked my main application <a href="http://192.168.0.1:8080/mainapp" rel="nofollow noreferrer">http://192.168.0.1:8080/mainapp</a>
  <br/>
  Is there something is wrong my perception on frame-ancestors of Content-Security-Policy?</p>