Add csp exception for youtube (#1844)

* Add csp exception for youtube * add youtube csp exception
bcgov · Jul 14, 2023 · 2f4fd41 · 2f4fd41
1 parent 10044b8
commit 2f4fd41
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/met-web/nginx/nginx.dev.conf b/met-web/nginx/nginx.dev.conf
@@ -42,7 +42,7 @@ http {
     # add in most common security headers
     add_header Content-Security-Policy "
       default-src 'self' https://kit.fontawesome.com https://ka-f.fontawesome.com data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; 
-      script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com 'unsafe-eval';
+      script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com https://www.youtube.com 'unsafe-eval';
       worker-src 'self' blob:;
       img-src 'self' data: blob: https://citz-gdx.objectstore.gov.bc.ca;
       style-src 'self' 'unsafe-inline';

diff --git a/met-web/nginx/nginx.prod.conf b/met-web/nginx/nginx.prod.conf
@@ -42,7 +42,7 @@ http {
     # add in most common security headers
     add_header Content-Security-Policy "
       default-src 'self' https://kit.fontawesome.com https://ka-f.fontawesome.com data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; 
-      script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com 'unsafe-eval';
+      script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com https://www.youtube.com 'unsafe-eval';
       worker-src 'self' blob:;
       img-src 'self' data: blob: https://citz-gdx.objectstore.gov.bc.ca;
       style-src 'self' 'unsafe-inline';

diff --git a/met-web/nginx/nginx.test.conf b/met-web/nginx/nginx.test.conf
@@ -42,7 +42,7 @@ http {
     # add in most common security headers
     add_header Content-Security-Policy "
       default-src 'self' https://kit.fontawesome.com https://ka-f.fontawesome.com data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; 
-      script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com 'unsafe-eval';
+      script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com https://www.youtube.com 'unsafe-eval';
       worker-src 'self' blob:;
       img-src 'self' data: blob: https://citz-gdx.objectstore.gov.bc.ca;
       style-src 'self' 'unsafe-inline';