`allow-from` is deprecated and ignored by all modern browsers
allow-from is deprecated and ignored by all modern browsersallow-fromx-frame-options, and instead setting a CSP, with frame-ancestors, and more explicitly specifying where you want it embedded: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors

Development Mode, but that will also affect my production deployment, if I understand correctly..pages.dev domain then they shouldn't be cached
domain.com/route but then I also have pages functions eg functions/connect-to-db.js what route will that server function be accessible at?


x-frame-optionsframe-ancestorsDevelopment Mode.pages.devdomain.com/routefunctions/connect-to-db.js