Content-Security-Policy is set to the following:
Content-Security-Policy: frame-ancestors 'self'
Does it also imply:
Content-Security-Policy: default-src 'self'
Or is it a lot safer to put both rules?
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
Updated, as mentioned by AlphaD in a comment, the "same-origin" is indicated by
default-src and not an hypothetical
same-origin option. I updated my question accordingly.