From 4aededf038a7f9ce8e99e29a8e6e7b6c5130e4b5 Mon Sep 17 00:00:00 2001 From: Omar Roth Date: Mon, 8 Apr 2019 09:39:47 -0500 Subject: [PATCH] Add media-src blob: to CSP --- src/invidious.cr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/invidious.cr b/src/invidious.cr index b0900aa0..a58749ac 100644 --- a/src/invidious.cr +++ b/src/invidious.cr @@ -169,7 +169,7 @@ proxies = PROXY_LIST before_all do |env| env.response.headers["X-XSS-Protection"] = "1; mode=block;" env.response.headers["X-Content-Type-Options"] = "nosniff" - env.response.headers["Content-Security-Policy"] = "default-src blob: data: 'self' 'unsafe-inline' 'unsafe-eval'; media-src 'self' https://*.googlevideo.com:443" + env.response.headers["Content-Security-Policy"] = "default-src blob: data: 'self' 'unsafe-inline' 'unsafe-eval'; media-src blob: 'self' https://*.googlevideo.com:443" env.response.headers["Referrer-Policy"] = "same-origin" if Kemal.config.ssl || config.https_only