# \[IGN-3627\]Perspective in iframe: X Frame Options and Content-Security-Policy

**URL:** <https://forum.inductiveautomation.com/t/ign-3627-perspective-in-iframe-x-frame-options-and-content-security-policy/103627>\
**Category:** Ignition\
**Tags:** perspective\
**Created:** [March 13, 2025, 2:03pm UTC](https://forum.inductiveautomation.com/t/ign-3627-perspective-in-iframe-x-frame-options-and-content-security-policy/103627 "2025-03-13T14:03:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![martin\_ignition](https://avatars.discourse-cdn.com/v4/letter/m/bcef8e/32.png) [@martin\_ignition](https://forum.inductiveautomation.com/u/martin_ignition)\
**Post date:** [March 13, 2025, 2:03pm UTC](https://forum.inductiveautomation.com/t/ign-3627-perspective-in-iframe-x-frame-options-and-content-security-policy/103627/1 "2025-03-13T14:03:00Z")

</div>

Hello,

I need to embed perspective screens in some company internal websites. The default X-Frame-Options forbids this, as the internal websites are not hosted using the same hostname.  
I'd like to not switch the mechanism off entirely. Is there a way to add Content-Security-Policy headers so that I could add the necessary domains as [`frame-ancestors`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors)?

Best regards, Martin

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [March 13, 2025, 2:42pm UTC](https://forum.inductiveautomation.com/t/ign-3627-perspective-in-iframe-x-frame-options-and-content-security-policy/103627/2 "2025-03-13T14:42:54Z")

</div>

Yes, various headers can be customized by providing appropriate system property flags in the `ignition.conf` file:

> **[Gateway and Gateway Network Parameters | Ignition User Manual](https://docs.inductiveautomation.com/docs/8.1/appendix/reference-pages/gateway-configuration-file-reference/gateway-and-gateway-network-parameters#x-content-type-options)**
>
> Gateway Parameters

---

<div class="post-metadata">

**Author:** ![martin\_ignition](https://avatars.discourse-cdn.com/v4/letter/m/bcef8e/32.png) [@martin\_ignition](https://forum.inductiveautomation.com/u/martin_ignition)\
**Post date:** [March 13, 2025, 4:56pm UTC](https://forum.inductiveautomation.com/t/ign-3627-perspective-in-iframe-x-frame-options-and-content-security-policy/103627/3 "2025-03-13T16:56:17Z")

</div>

Thank you for the answer.  
Is there a general method I'm not seeing? That page doesn't mention content security policy headers as far as I can tell.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [March 13, 2025, 5:01pm UTC](https://forum.inductiveautomation.com/t/ign-3627-perspective-in-iframe-x-frame-options-and-content-security-policy/103627/4 "2025-03-13T17:01:01Z")

</div>

Ah, yeah, my bad. We don't have a way to supply arbitrary CSP directive(s); that's an internal feature ticket I just added this thread to.