How do I merge 2 Content-Security-Policy headers?

Question

I have an existing Content-Security-Policy header in my web.config file:

<add name="Content-Security-Policy" value="default-src https: data: 'unsafe-inline' 'unsafe-eval'" />

I want to add an additional rule:

<add name="Content-Security-Policy" value="frame-ancestors 'self' https://*.example.com" />

How do I add this second header line, so that both these rules can exist and not override each other?

Answer 1

I solved it. This is the merged line:

<add name="Content-Security-Policy" value="default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' https://*.example.com" />