Added youtube to CSP headers.

diff --git a/customer/mbvd-ngcc/dev-web-ngcc-daimler.pixelpark.net.yaml b/customer/mbvd-ngcc/dev-web-ngcc-daimler.pixelpark.net.yaml
index 4d1a030f6744cc8ddb380c04cc8e53c6508a3866..0980d9c9559ad4990f450834bdf83ad374057bc4 100644 (file)
--- a/customer/mbvd-ngcc/dev-web-ngcc-daimler.pixelpark.net.yaml
+++ b/customer/mbvd-ngcc/dev-web-ngcc-daimler.pixelpark.net.yaml
@@ -41,8 +41,8 @@ site::profile::apache::pp_vhosts:
       - 'set X-Content-Type-Options: nosniff'
       - 'set X-XSS-Protection: "1; mode=block"'
       - 'set X-Frame-Options: "ALLOW-FROM https://dev-cms01-ngcc-daimler.pixelpark.net"'
-      - "set Content-Security-Policy: \"default-src 'self'; font-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; media-src 'self' data:\""
-      - "set X-Content-Security-Policy: \"default-src 'self'; font-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; media-src 'self' data:\""
+      - "set Content-Security-Policy: \"default-src 'self'; font-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; media-src 'self' data:; child-src https://*.youtube.com\""
+      - "set X-Content-Security-Policy: \"default-src 'self'; font-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; media-src 'self' data:; child-src https://*.youtube.com\""
     headers_ssl:
       - 'always set Strict-Transport-Security "max-age=31556926"'
     custom_fragment: |