Remove X-Frame-Options in favor of CSP frame-ancestors
Change-Id: I23a54a25cab8ec532618c82a403802ef2c9224b8
diff --git a/t/page.t b/t/page.t
index 9146c0f..0be13c8 100644
--- a/t/page.t
+++ b/t/page.t
@@ -29,11 +29,11 @@
->header_like('Content-Security-Policy', qr!media-src 'none';!)
->header_like('Content-Security-Policy', qr!object-src 'self';!)
->header_like('Content-Security-Policy', qr!nonce-!)
+ ->header_like('Content-Security-Policy', qr!frame-ancestors 'self';!)
->content_like(qr/<script nonce/)
->content_like(qr/document\.body\.classList\.remove\(\'no-js\'\);/)
->header_is('X-Content-Type-Options', 'nosniff')
->header_is('Access-Control-Allow-Methods','GET, POST, OPTIONS')
- ->header_is('X-Frame-Options', 'sameorigin')
->header_is('X-XSS-Protection', '1; mode=block')
;