We are using a Custom Tab on our Facebook Page and it is built in an iframe on our own website.
All of a sudden we are getting this error and the iframe is blocked:
Refused to frame 'https://www.mywebsite.com/' because it violates the following Content Security Policy directive: "default-src 'self' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: *.whatsapp.com whatsapp.com *.whatsapp.net whatsapp.net". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.
We haven't changed anything so would guess it is a change that Facebook have made.
I have tried adding <meta> tags to the header, but am still getting the error message and the iframe is not loading in the custom tab on the Facebook Page.
Any ideas on how to resolve this?
Update : Looks like this might be a current bug with Facebook : https://developers.facebook.com/support/bugs/386260146322594/?join_id=f28b0ca1724537c
Update : This bug is now here https://developers.facebook.com/support/bugs/268717971719721/?join_id=ff134a3080fdec