Header deprecated: X-Frame-Options

[mdPlusPlus]

According to MDN the use of this header is deprecated: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Apparently it's supposed to be replaced by the frame-ancestors CSP: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors

I'm no expert, but it seems like to implement what was X-Frame-Options DENY is now this in CSP:

• Apache: Header always set Content-Security-Policy "frame-ancestors 'none';"
• NGINX: add_header Content-Security-Policy "frame-ancestors 'none';";
• Lighttpd: "Content-Security-Policy" => "frame-ancestors 'self' https://myhomeassistant.mydomain.tld;"

Disclaimer: All of this is untested