Domain example1.com embeds my iframe.
Domain example2.com embeds an iframe served from example1.com.
I would set
X-Frame-Options: ALLOW FROM *.example1.com as well as
But then the browser does not allow showing the iframe content, because the window's domain is example2.com which does not equal example1.com.
How can I require whitelisting for the embedder (example1.com) and also for the embedder's embedder (example2.com)?