CSP & iframe subresources

Does the CSP policies of the main HTML apply also subresources of iframes?

What happens if the iframe also has it's own CSP policy? Is it additive to
the main HTML policies?

Is there a difference in that aspect between different kinds of iframes?
(3rd party, sandboxed, etc)

Thanks,
Yoav

Received on Friday, 11 January 2013 09:39:57 UTC