Merge pull request #4127 from guardian/CSP/frame-src/add-youtube

guardian · Aug 1, 2023 · 8992092 · 8992092
2 parents 8323361 + b1db23b
commit 8992092
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/kahuna/app/KahunaComponents.scala b/kahuna/app/KahunaComponents.scala
@@ -39,7 +39,7 @@ object KahunaSecurityConfig {
 
     val gaHost = "www.google-analytics.com"
 
-    val frameSources = s"frame-src ${config.services.authBaseUri} ${config.services.kahunaBaseUri} https://accounts.google.com ${config.scriptsToLoad.map(_.host).mkString(" ")}"
+    val frameSources = s"frame-src ${config.services.authBaseUri} ${config.services.kahunaBaseUri} https://accounts.google.com https://www.youtube.com ${config.scriptsToLoad.map(_.host).mkString(" ")}"
     val frameAncestors = s"frame-ancestors ${config.frameAncestors.mkString(" ")}"
     val connectSources = s"connect-src 'self' ${(services :+ config.imageOrigin).mkString(" ")} $gaHost ${config.connectSources.mkString(" ")}"