title: How to "avoid" Content Security Policy?
body: <p>I'm working for a company as external researcher. They gave me a vpn, rsa token and credentials to access to their online portal which contains web pages on their projects. I'm building a Flask app and I'd like to embed their pages in a frame but the CSP deny this operation. At the moment this tool is running locally and I'll never put it on their production or test server. In the frame, a message appears instead of the page content, saying: </p>
  
  <blockquote>
    <p>Blocked by Content Security Policy: this page has a content security police that prevents it from being loaded in this way. Firefox prevented this page from loading in this way because the page has a content security policy that disallow it.</p>
  </blockquote>
  
  <p>while the console message says:</p>
  
  <pre><code>Content Security Policy: Ignoring 'x-frame-options' because of 'frame-ancestors' directive
  </code></pre>
  
  <p>I'm not confident with CSP, I just read a cuple of pages on the topic. As I can access to their pages by browser (like all the future users of the tool), are there any solution to embed these pages in a frame?</p>