The frame being accessed set "document.domain" to "site.ru", but the frame requesting access did not. Both must set "document.domain" to the same value to allow access.
Blocked a frame with origin "https://cdn.site.ru" from accessing a frame with origin "https://site.ru". Protocols, domains, and ports must match.
Blocked a frame with origin "https://cdn.site.ru" from accessing a frame with origin "https://site.ru". Protocols, domains, and ports must match.
<code lang="ruby">
before_filter :set_csp
def set_csp
csp = "default-src 'self';"
csp += "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://yandex.st/swfobject;"
csp += "style-src 'self' 'unsafe-inline';"
csp += "frame-src 'self' https://www.youtube.com https://cdn.mysite.ru"
response.headers['Content-Security-Policy'] = csp
end
</code>