You need to hijack/intercept the logic to force the parent to match the origin, or in this case remove the CSP via a kind of proxy call.
Here is a complete example
You need to hijack/intercept the logic to force the parent to match the origin, or in this case remove the CSP via a kind of proxy call.
Here is a complete example