21254 youtube media player

middleware.js

@@ -9,12 +9,12 @@ export function middleware(request) {
             process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
         };
         style-src 'self' 'unsafe-eval' 'unsafe-inline';
-        img-src 'self' 'unsafe-inline'  https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com  blob: data:;
+        img-src 'self' 'unsafe-inline'  https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com  blob: data: https://img.youtube.com;
         connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
         font-src 'self'  https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
         object-src 'none';
         base-uri 'self';
-        frame-src https://datamap.gov.wales/;
+        frame-src https://datamap.gov.wales/ https://www.youtube.com https://www.youtube-nocookie.com;
         form-action 'self' ` +
         process.env.NEXTAUTH_URL +
         `;
@@ -49,7 +49,7 @@ export function middleware(request) {
     // CSP policy
     requestHeaders.set(
         "Content-Security-Policy",
-        contentSecurityPolicyHeaderValue
+        contentSecurityPolicyHeaderValue,
     );
 
     const response = NextResponse.next({
@@ -59,7 +59,7 @@ export function middleware(request) {
     });
     response.headers.set(
         "Content-Security-Policy",
-        contentSecurityPolicyHeaderValue
+        contentSecurityPolicyHeaderValue,
     );
 
     // XSS protection (legacy)
@@ -77,13 +77,13 @@ export function middleware(request) {
     // Permissions lockdown
     response.headers.set(
         "Permissions-Policy",
-        "geolocation=(), camera=(), microphone=(), fullscreen=(self)"
+        "geolocation=(), camera=(), microphone=(), fullscreen=(self)",
     );
 
     // Enforce HTTPS via HSTS
     response.headers.set(
         "Strict-Transport-Security",
-        "max-age=63072000; includeSubDomains; preload"
+        "max-age=63072000; includeSubDomains; preload",
     );
 
     return response;