The colon is required and scheme should not be quoted. Warning: If no URL scheme is specified for a host-source and the iframe is loaded from an https URL, the URL for the page loading the iframe must also be https, per the Does URL match expression in origin with redirect count? section of the CSP spec. Permissions-Policy: xr-spatial-tracking Experimental.Permissions-Policy: storage-access Experimental.Permissions-Policy: speaker-selection Experimental.Permissions-Policy: serial Experimental.Permissions-Policy: screen-wake-lock Experimental.Permissions-Policy: publickey-credentials-get Experimental.Permissions-Policy: publickey-credentials-create Experimental.Permissions-Policy: picture-in-picture Experimental.Permissions-Policy: payment Experimental.Permissions-Policy: magnetometer Experimental.Permissions-Policy: local-fonts Experimental.Permissions-Policy: idle-detection Experimental.Permissions-Policy: identity-credentials-get Experimental.Permissions-Policy: gyroscope Experimental.Permissions-Policy: gamepad Experimental.Permissions-Policy: execution-while-out-of-viewport Experimental.Permissions-Policy: execution-while-not-rendered Experimental.Permissions-Policy: encrypted-media Experimental.Permissions-Policy: document-domain Experimental.Permissions-Policy: battery Experimental.Permissions-Policy: autoplay Experimental.Permissions-Policy: ambient-light-sensor Experimental.Permissions-Policy: accelerometer Experimental.Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed.Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channel.Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'.

Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'.

Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials'.

Reason: Did not find method in CORS header 'Access-Control-Allow-Methods'.

Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*'.

Reason: CORS request external redirect not allowed.

Reason: CORS preflight channel did not succeed.

Reason: CORS header 'Origin' cannot be added.

Reason: CORS header 'Access-Control-Allow-Origin' missing.

Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'.

CSP: require-trusted-types-for Experimental.

CSP: prefetch-src Non-standard Deprecated.

CSP: plugin-types Non-standard Deprecated.

CSP: block-all-mixed-content Deprecated.

Sec-CH-UA-Platform-Version Experimental.

Sec-CH-UA-Full-Version-List Experimental.

Sec-CH-Prefers-Reduced-Motion Experimental.

Large-Allocation Non-standard Deprecated.

Accept-CH-Lifetime Non-standard Deprecated.

Scp memory access violation fix