带有Firebase托管的无效X-Frame-Options

Question

Firebase托管几乎没有问题。

1）我已经根据this post配置了托管标头，但仍显示以下错误：

错误：Invalid 'X-Frame-Options' header encountered when loading 'https://cross-domain-services.firebaseapp.com/auth': 'ALLOW-FROM https://www.tgif.my' is not a recognized directive. The header will be ignored.

下面是我的firebase.json：

"hosting": {
    "public": "dist/cross-domain-services",
    "ignore": [
      "firebase.json",
      "**/.*",
      "**/node_modules/**"
    ],
    "rewrites": [
      {
        "source": "**",
        "destination": "/index.html"
      }
    ],
    "headers":[
      {
        "source":"/auth",
        "headers":[
          {
            "key":"X-Frame-Options",
            "value":"ALLOW-FROM https://www.tgif.com.my"
          },
          {
            "key":"X-Frame-Options",
            "value":"ALLOW-FROM https://www.tgif.my"
          }
        ]
      }
    ]
  }

2）当我在本地使用iframe服务另一个项目时，iframe将显示https://cross-domain-services.firebaseapp.com/auth页面内容。它不应该显示内容吗？请告知。

谢谢。