[openstreetmap/openstreetmap-website] Content Security Policy (Issue #4614)

[KK]

### URL

_No response_

### How to reproduce the issue?

I am able to download and play videos locally without any issues. However, after deploying to an Alibaba Cloud server, I encountered errors. The browser refused to frame 'https://jimmywarting.github.io/' because it violates the following Content Security Policy directive: "frame-src 'self'". Additionally, there was an error when trying to play the video: Refused to load media from 'https://app.uav.gafly.cn/video/frecord/4TADL47001007K_165-0-7_normal-0_77_8HUECT/20240322/20240322063456/4TADL47001007K_165-0-7_normal-0_77_8HUECT_record.m3u8?token=o76uejjnjPaAZBNuU3Ak7MZ71iDzXySPtnCiGuYIkPR.joxNzExNDE4NTY2LCJwIjoiZTM2NzY0YTc0YWI1YmE1MTMxZTAxNWU1MTI3NGMzOTA4MDM5NjJhOThlYTdhYzgzM2M1MzA1MjkzMzM0ZDRlYyIsInQiOjE3MTA4MTM3NjYsInUiOiJmMDNlMjEifQeyJlI.ciOiJIUzI1NiIsInR5cCI6IkpXVCJ9eyJhbG' as it violates the Content Security Policy directive: "media-src https://uav.video.gafly.cn/ blob:"

### Screenshot(s) or anything else?

<img width="1099" alt="1711096534663" src="https://github.com/openstreetmap/openstreetmap-website/assets/116629035/593a5e16-8d6b-4e60-b088-b7f570f05c46">


-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/4614
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/issues/4614 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20240322/c93b1d52/attachment.htm>