search

spech66 / bootstrap-bp-hugo-theme

Bootstrap based Hugo theme which provides out of the box best practices.
https://www.spech.de/
MIT License
54 stars 23 forks source link

YouTube videos not showing because of CSP #9

Closed ErickCastellanos closed 4 years ago

ErickCastellanos commented 4 years ago

While using the {{< youtube >}} functionality, the associated embeded video won't show.

The error is about content security policy and the frame-src not being specified for youtube-nocookie.com domain. (I'm using the privacy enhanced feature).

A solution is to modify the static/.htaccess header for CSP and adding *.youtube-nocookie.com

As a rapid hack, it's ok and it works, but I do not think it's the best solution because it won't work in non-apache servers (eg. nginx?). And I'll prefer to have some sort of parameter defined in the config.toml in order to specify the domains I want for my site, and then dynamically create the .htacess file from that parameter.

For example, if that would be the case, I'd remove the *.de domains because those are not related to my sites (me being outside Germany).

This is more of a wish-bug, hopefully you can think of a better solution. Or ...

I'm new to Hugo, so not sure how to make that possible, but if you can point me to education resource on how/where to create that file dynamically from some parameter, I could help you with that and creating a pull request.

spech66 commented 4 years ago

Thank you for pointing out the missing domains. I added all YT domains.

The .htaccess file is supposed to be a sample. You can copy it to your static folder and make all the changes you want. For the nginx config please have a look at my hugo-best-practices repo.