frame-ancestors not recognized with default-src 'none'

[arigon]

Hello

when using default-src 'none' and no attribute for frame-ancestors, the tool will give a negative rating for Clickjacking protection, using frame-ancestors.

If I change it to default-src 'none'; frame-ancestors 'none' it will give a positive rating.

[rugk]

That is correct. frame-ancestors does not fallback to default-src.

Maybe the message should be clarified though?

[gene1wood]

@rugk Can you propose a clarified message?

[rugk]

Hmm what is the current text?

[gene1wood]

I'm unsure but it should be discoverable in the code.