A developer wants to prevent their authentication page from being framed by any site, including their own subdomains. Which Content Security Policy directive achieves this precisely?

• A.Content-Security-Policy: frame-ancestors 'none' - this prevents the page from being embedded in any frame, iframe, or object element from any origin, including same-origin and subdomain requests. X-Frame-Options: DENY provides the same protection but frame-ancestors is more flexible and overrides X-Frame-Options in browsers that support CSP Level 2+
• B.Content-Security-Policy: frame-src 'none' - this prevents the page from loading any frames of its own, but it does not stop other sites from embedding the login page, and X-Frame-Options: SAMEORIGIN already covers that gap for subdomains, which is why frame-src 'none' is the directive that protects an authentication page from clickjacking when the response is delivered over HTTPS
• C.X-Frame-Options: ALLOW-FROM none - this tells the browser to allow framing from no listed origin, but the header is obsolete in current browsers, and CSP frame-ancestors with 'self' is what blocks subdomains, which keeps same-origin framing working for the login page in every browser that supports CSP Level 2 in every mainstream desktop browser released after 2015