如何仅限制从外部站点到特定域的iframe显示

Content-Security-Policy: frame-ancestors 'self' https://allowed-domain.com;

Header set Content-Security-Policy "frame-ancestors 'self' https://allowed-domain.com;"

add_header Content-Security-Policy "frame-ancestors 'self' https://allowed-domain.com;";

const helmet = require('helmet');

app.use(helmet.contentSecurityPolicy({
  directives: {
    frameAncestors: ["'self'", 'https://allowed-domain.com']
  }
}));

header("Content-Security-Policy: frame-ancestors 'self' https://allowed-domain.com;");