CODEWITHSUNDEEP
content-security-policy
RaviKiran
RaviKiran

Reputation: 111

Effective Content Security Policy definition for YouTube.com

I defined content security policies for one of the application which uses JavaScript files from https://www.youtube.com/iframe_api as follows;

<meta http-equiv="Content-Security-Policy"
content="script-src 'self' https://www.youtube.com;
child-src https://www.youtube.com;">

Now on chrome dev tools, I get the error below:

Refused to load the script 'https://s.ytimg.com/yts/jsbin/www-widgetapi-vflaaT2_k/www-widgetapi.js' because it violates the following Content Security Policy directive: "script-src 'self' https://www.youtube.com".

Should I add https://s.ytimg.com to the content security policy settings?

If yes, does it constitute a security risk as one cannot guarantee whether it may change over time?

How can I effectively define content security policies for YouTube?

Upvotes: 9

Views: 6779

Answers (1)

Barry Pollard
Barry Pollard

Reputation: 45870

Yes that's exactly what you need to do. Ytimg is YouTube's CDN for static files.

Upvotes: 6

Related Questions