Report Iframe nesting level instead of using frame-ancestors directive

[moonyowl]

To prevent webpage loading in iframes, we have to use X-Frame-Options header or frame-ancestors CSP directive. It's very inefficient way because it works as "rule for browser". Instead of that, it will be more efficient to report iframe nesting level to server and handle this situation at server.

TL;DR: we should send such requests

Origin: example.com
Frame-Level: 1

instead of such responses

Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: sameorigin

[annevk]

https://github.com/mikewest/sec-metadata does this ("nested-document"). I'm not convinced it's worth adding a header just for frame-nesting level though.