child-src

self

The HTTP Content-Security-Policy (CSP) child-src directive defines the valid sources for 
web workers
 and nested browsing contexts loaded using elements such as 
<frame>
 and 
<iframe>
. For workers, non-compliant requests are treated as fatal network errors by the user agent.