# Adding CSP header
**URL:** https://meta.discourse.org/t/adding-csp-header/78920
**Category:** Development
**Created:** [January 24, 2018, 10:01pm UTC](https://meta.discourse.org/t/adding-csp-header/78920 "2018-01-24T22:01:54Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Michael\_Katrantzis1](https://meta.discourse.org/u/Michael_Katrantzis1)
#### Post date: [January 24, 2018, 10:01pm UTC](https://meta.discourse.org/t/adding-csp-header/78920/1 "2018-01-24T22:01:54Z")
I am trying to create a vary basic .rb plugin (based on the now obsolete in chrome) [discourse-allowall](https://github.com/musketyr/discourse-allowall)which will merge the CSP header to the default ones but cant get it to work.
The below does not seem to do it.
```plaintext
Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Policy' => "frame-ancestors 'http://mylocal.com.localhost'"})
```
I literally have 0 experience with ruby so need to know:
1. If thats possible
2. The correct syntax for defining the above header and merging it with the default ones
End goal is to make my discourse site frameable by 2 specific domains
---
### Author:  [@Michael\_Katrantzis1](https://meta.discourse.org/u/Michael_Katrantzis1)
#### Post date: [January 24, 2018, 11:43pm UTC](https://meta.discourse.org/t/adding-csp-header/78920/2 "2018-01-24T23:43:03Z")
My syntax was off and this is working fine now. Correct syntax is like:
`Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Policy' => "frame-ancestors mylocal.com.localhost"})`
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [March 23, 2021, 12:17am UTC](https://meta.discourse.org/t/adding-csp-header/78920/3 "2021-03-23T00:17:46Z")
Support for this was added in core: [Mitigate XSS Attacks with Content Security Policy - #37 by Falco](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/37)