title: How do I show video content when Content Security Policy is in place?
body: <p>I am hoping that there is an easy answer to this one.</p>
  
  <p>I am embedding a video from Vimeo on a page using the "fancybox" tools. Fancybox essentially creates an iFrame and embeds the Vimeo player.  It works great in all browsers - until I turn Content Security Policy on.  Then ID works (since it doesn't implement CSP) but Chrome and Firefox just hang with the "loading" image shown.</p>
  
  <p>I've tried this CSP:</p>
  
  <pre><code>&lt;add header="Content-Security-Policy" value="default-src 'self'; media-src 'self' http://player.vimeo.com; frame-src 'self' http://player.vimeo.com; " /&gt;
  &lt;add header="X-Content-Security-Policy" value="default-src 'self'; media-src 'self' http://player.vimeo.com; frame-src 'self' http://player.vimeo.com; " /&gt;
  &lt;add header="X-WebKit-CSP" value="default-src 'self'; media-src 'self' http://player.vimeo.com; frame-src 'self' http://player.vimeo.com; " /&gt;
  </code></pre>
  
  <p>The thinking, of course, is that I am permitting both media and my iframe to come from vimeo.  But it doesn't work.  Does anyone know why?</p>
  
  <p>UPDATE: I removed CSP for just the page showing video and looked at the content with Google's developer tools.  I turns out that Vimeo brings in a ton of other stuff from other Vimeo sub-domains, vimeocdn.com, conviva.com, lphbs.com, and even Amazon's aws.  So - if you use Vimeo (and YouTube?) you either have a very long list of external sites or you just don't use CSP?  Any insight would be appreciated!</p>