Embed mashup in iFrame

Hello,

I want to embed in another website a mashup as iframe.

I have done the configuration like explained in the help :

https://support.ptc.com/help/thingworx/platform/r9/en/index.html#page/ThingWorx%2FHelp%2FComposer%2FSecurity%2FAllowingEmbeddedMashupsiniFrames.html

In the filter "ClickjackFilterWhiteList", I have added domain : http://aa.bb.fr

But it's not working...

With Postman, when I do a get on my url:

http://xxx/Thingworx/Mashups/TEST_VIEW?appKey=xxx&x-thingworx-session=true

I can see the headers:

Content-Security-Policy : frame-src http://aa.bb.fr

Content-Security-Policy : frame-ancestors http://aa.bb.fr

X-Frame-Options : ALLOW-FROM http://aa.bb.fr

So, I guess my config in web.xml is ok.

In the browser, when I enter my url :

http://xxx/Thingworx/Mashups/TEST_VIEW?appKey=xxx&x-thingworx-session=true

The page load but is redirect to url :

http://xxx/Thingworx/Runtime/index.html#mashup=TEST_VIEW&appKey=xxx&x-thingworx-session=true

I can see in the console that CSP (content-security-policy) are not set here. Just the default :