bug: fix csp erros with youtube

hackclub · Sep 17, 2024 · 96119d5 · 96119d5
1 parent fee5bdc
commit 96119d5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/middlewares/security.go b/middlewares/security.go
@@ -6,7 +6,7 @@ import (
 
 var securityHeaders = map[string]string{
 	"Cross-Origin-Opener-Policy": "same-origin",
-	"Content-Security-Policy":    "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' https: data:; form-action 'self' *.stripe.com; block-all-mixed-content;",
+	"Content-Security-Policy":    "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' https: data:; frame-src 'self' https://www.youtube.com https://youtube.com; form-action 'self' *.stripe.com; block-all-mixed-content;",
 	"X-Frame-Options":            "DENY",
 	"X-Content-Type-Options":     "nosniff",
 }