node.js – 尝试渲染i-frame：ancestor违反了以下内容安全策略指令：“frame-ancestors’none’”

<iframe src="https://gist.github.com/user45445/9bf8d568e3350146ba302d7d67ad576f"> </iframe>

这是我在控制台中遇到的错误：@H_673_10@拒绝在框架中显示“https://gist.github.com/fresh5447/9bf8d568e3350146ba302d7d67ad576f”,因为祖先违反了以下内容安全策略指令：“frame-ancestors’none’”.

我正在研究如何在我的节点服务器中指定我的内容安全策略,以指定它应该接受来自github的任何iframe

所以我安装了csp-helmet并将其添加到我的服务器代码中：

var csp = require('HelR_237_11845@et-csp')

app.use(csp({
  // Specify directives as normal.
  directives: {
    frameAncestors: ['*.github.com'],//I thought these two did the same,so I tried them both.
    childSrc: ['*.github.com']
  },// Set to true if you only want browsers to report errors,not block them.
  // You may also set this to a function(req,res) in order to decide dynamically
  // whether to use reportOnly mode,e.g.,to allow for a dynamic kill switch.
  reportOnly: false,// Set to true if you want to blindly set all headers: Content-Security-Policy,// X-WebKit-CSP,and X-Content-Security-Policy.
  setAllHeaders: false,// Set to true if you want to disable CSP on Android where it can be buggy.
  disableAndroid: false,// Set to false if you want to completely disable any user-agent sniffing.
  // This may make the headers less compatible but it will be much faster.
  // This defaults to `true`.
  browserSniff: true
}))

但仍然是同样的错误..

我一直试图看看official docs和HTML5 rocks guide

不确定我是否超级接近或采取完全错误的方法.

更新

我还尝试通过元标记设置CSP.

<Meta http-equiv="Content-Security-Policy" content="child-src https://gist.github.com; frame-ancestors https://gist.github.com;">

比我收到这个错误：

Content Security Policies delivered via a <Meta> element may not contain the frame-ancestors directive.

提前致谢.