Couldn't Google, Facebook etc. just set a CSP that forbids embedding certain pages of theirs? E.g. Facebook forbidding embedding their facebook.com/me. Edited

Couldn't Google, Facebook etc. just set a CSP that forbids embedding certain pages of theirs? E.g. Facebook forbidding embedding their facebook.com/me. Edited to add: There are two standards to disallow embedding, but both don't apply to <img> tags: The X-Frame-Options header [1] applies to frame, iframe and object elements. CSP's frame-ancestors directive [2] applies to "frame, iframe, object, embed or applet tag, or equivalent functionality in non-HTML resources". There's may still be an option for blocking embedding as an image though: When trying to load a URL, AFAIK a browser sends a list of accepted content types. This should make it possible for a website to detect when a browser is trying to load a webpage as an image, which the website then can simply respond to e.g. with an error code. [1] http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-00 http://tools.ietf.org/html/draft-ietf-websec-x-frame-options... [2] https://w3c.github.io/webappsec/specs/content-security-policy/#directive-frame-ancestors https://w3c.github.io/webappsec/specs/content-security-polic...