Shopware App - "Refused to frame 'https://***.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors

As described in the Shopware App documentation, our app is loaded in an iframe, the content of our app comes from one of our servers. For this we used these parts in manifest.xml.

 <admin>
        <module name="magnalister"
                source="https://***.com/app/index"
                parent="sw-marketing"
                position="50"
        >

However, when opening our app page in a Shopware shop, a "Whoops" page appears. The error in the browser console is: "Refused to frame 'https://***.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'". You can also see the error in the screenshot. If we open our app in a new tab, we can see the content of the app. Our app cannot have any influence on "frame-ancestors". Shopware itself must allow app URL to load in iframe.

It doesn't work that way for us, we can't tell all customers to open our app in a new tab. I guess "frame-ancestors" should be set from Shopware. Does Shopware want to change this? If Shopware doesn't want to change it, why this possibility exist in its manifest.xml to support app loaded from another domain.

It's your app server that doesn't allow rendering of your page inside an iframe on another page. You have the frame-ancestors policy set to none, which similar to the X-Frame-Options: DENY header, will disallow any framing at all.