# with ALLOWED_HOSTS=domain1 domain2
# header
Content-Security-Policy: frame-ancestors domain1 domain2;
# with ALLOWED_HOSTS=domain1,domain2
# header
Content-Security-Policy: frame-ancestors domain1,domain2;
# console
Unrecognized Content-Security-Policy directive 'domain2'.

# with ALLOWED_HOSTS=domain1,domain2 or ALLOWED_HOSTS=domain1 domain2
# header
Content-Security-Policy: frame-ancestors domain1 domain2;