title: Facebook app fails to load - Content Security Policy "frame-src"
body: <p>We have a Facebook app that has been around for a long time. It's a page-based app, loading up in an iframe. Of late, it is failing to load, and this error appears in the Chrome console:</p>
  <pre><code>[Report Only] Refused to frame 'https://edit.ihouseelite.com/' because it violates the following Content Security Policy directive: &quot;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com&quot;.
  </code></pre>
  <p>You can see the problem in our test page:</p>
  <pre><code>https://www.facebook.com/Test-page-1158553550884937/app/451851288205481
  </code></pre>
  <p>First - this message starts with &quot;Report Only&quot;. Does that mean that this error is not really an error, but perhaps an indication of future problems?</p>
  <p>Assuming that it really is an error, how do I fix it? It seems like the CSP is something set by Facebook, so they only permit specific domains to load up in iframes within a Facebook page. Or am I reading that incorrectly? I figured that setting the domain in the App Settings (basic) would adjust the CSP, but it doesn't seem to have done that.  We have a couple thousand customers who are using our app, so I would really like to figure out how to fix this. All suggestions welcome.</p>