<iframe>不响应302响应

我有一个交叉起源的框架 https://b.example.com/some/uri/ 嵌入 https://a.example.com 嵌入式网站会自动转到openID身份验证提供商,但在服务器返回302重定向时遇到问题。

这就是请求的样子:

Request URL: https://oidc.example.com/openid/auth/?client_id=CLIENT_ID&redirect_uri=https://b.example.com/callback&response_type=code
Request Method: GET
Status Code: 302 Found

但是响应头看起来不同

如果 b.example.com

Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Tue, 13 Aug 2019 17:53:32 GMT
**Location: https://b.example.com/callback?code=CODE**
Server: nginx
Vary: Cookie

如果 b.e.example.com a.example.com

Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Tue, 13 Aug 2019 17:52:08 GMT
**Location: /login/?next=/openid/auth/?client_id=CLIENT_ID&redirect_uri=https://b.example.com/callback&response_type=code**
Server: nginx
Vary: Cookie

所以我需要iframe对302做出反应,就像它在新标签页中作为独立网站打开一样。我试着加上 Content-Security-Policy 标题

Content-Security-Policy: frame-ancestors 'self' https://oidc.example.com https://b.example.com https://a.example.com

但没用。有没有办法让iframe对302个响应做出反应?