fix: add cdn.getunleash.io to media-src (#11168)

Add self and cdn as allowed sources for mediaSrc in our CSP.
2026-01-23 20:06:43 +01:00 · 2025-12-18 09:35:12 +01:00 · 2025-12-18 09:35:12 +01:00 · bc4b6cdf1f
commit bc4b6cdf1f
parent 97d393059f
1 changed files with 2 additions and 0 deletions
--- a/src/lib/middleware/secure-headers.ts
+++ b/src/lib/middleware/secure-headers.ts
@ -64,6 +64,8 @@ const secureHeaders: (config: IUnleashConfig) => RequestHandler = (config) => {
                        ...config.additionalCspAllowedDomains.connectSrc,
                    ],
                    mediaSrc: [
+                        "'self'",
+                        'cdn.getunleash.io',
                        '*.youtube.com',
                        '*.youtube-nocookie.com',
                        ...config.additionalCspAllowedDomains.mediaSrc,