From ab4f02f74aa58d8d77ce883707e8df0dbb7640a0 Mon Sep 17 00:00:00 2001
From: jawelton74 <103591340+jawelton74@users.noreply.github.com>
Date: Thu, 29 May 2025 10:54:37 -0700
Subject: [PATCH] Remove frame-src from CSP. (#2169)

---
 web.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web.config b/web.config
index 294afb8d8..8efe7ce6d 100644
--- a/web.config
+++ b/web.config
@@ -30,7 +30,7 @@
         <clear />
         <add name="X-Xss-Protection" value="1; mode=block" />
         <add name="X-Content-Type-Options" value="nosniff" />
-        <add name="Content-Security-Policy" value="frame-src vscode: login.microsoftonline.com; frame-ancestors 'self' portal.azure.com *.portal.azure.com portal.azure.us portal.azure.cn portal.microsoftazure.de df.onecloud.azure-test.net *.fabric.microsoft.com *.powerbi.com *.analysis-df.windows.net dataexplorer-preview.azurewebsites.net login.microsoftonline.com" />
+        <add name="Content-Security-Policy" value="frame-ancestors 'self' portal.azure.com *.portal.azure.com portal.azure.us portal.azure.cn portal.microsoftazure.de df.onecloud.azure-test.net *.fabric.microsoft.com *.powerbi.com *.analysis-df.windows.net dataexplorer-preview.azurewebsites.net" />
       </customHeaders>
       <redirectHeaders>
         <clear />