I'm working on a canvas app. I need to prevent it from being iframed from unauthorized sources. The problem is I don't know what to set as the CSP frame-ancestors in the headers for my canvas app. It doesn't seem to be the instance url the user is on.
I tried a number of things. There were fields in the signed request I thought might be the ancestor for my canvas app. I tried signedRequest.client.targetOrigin and signedRequest.environment.locationUrl to no avail.
I noticed that canvas is putting the actual iframe for my app inside an outer iframe. I imagine that could change what address is considered the ancestor of my app's iframe.
I checked window.location.ancestorOrigins (evaluated within my app) and tried setting the report-uri directives in the CSP header to see if the csp-report had any useful information. I tried hard coding the promising urls I found as the frame-ancestors. None of them worked.