Both options seem to control who can embed the content in an
<iframe> tag, just like
X-Frame-Options does. Chrome and Safari are deprecating this header (partially,
allow-from for instance), so it's a matter of time that it will no longer used by Firefox and Edge as well, so only Content-Security-Policy will be available.
I've been doing some tests, and the same result (block / allow specific domain) is achieved by using either of those options, so, what's really the difference between them?
Expecting some usage examples where one is useful and the other it's not.