[Sunilsbcloud]

Summary

Jira: CORE-8421 (related to CORE-8392).

Learner activity embeds for YouTube, Vimeo, and Canva are blocked on https://app.p2-sandbox.practera.com. The enforcing sandbox CSP has no frame-src, so the browser falls back to default-src 'self' and blocks those frames. The report-only policy logs the same gap but does not block it.

This PR adds one sandbox directive:

frame-src 'self' https://www.youtube.com https://www.youtube-nocookie.com https://player.vimeo.com https://www.canva.com

https://www.youtube-nocookie.com is included because Plyr is configured with youtube.noCookie: true.

PR #2797 stays intact. script-src is still nonce-<per-deploy> 'strict-dynamic' 'unsafe-inline' 'self' https://acsbapp.com. These media hosts are not added to script-src or connect-src. The shared report-only CSP template is unchanged.

The accessiBe config fetch to https://cdn.acsbapp.com remains a separate connect-src issue and is not part of this PR.

Test plan

• node scripts/assert-app-csp.cjs passed. It locks the new frame-src allowlist, rejects a wildcard in that directive, and checks that YouTube, Vimeo, and Canva are absent from script-src and connect-src. It also checks that the nonce and 'strict-dynamic' still apply to the sandbox template and to every sample script tag.
• After merge and the sandbox app deploy, open the learner task "Test Content for SRC" and confirm the Canva embed and the Vimeo player render.
• Confirm a YouTube activity embed plays, including the Plyr no-cookie host.
• Confirm the live content-security-policy header still contains the per-deploy nonce and 'strict-dynamic', and that the HTML script nonce matches.
• Confirm login, GraphQL, and realtime still connect. This change does not alter those directives.
• Console lines that say the policy is report-only can remain. They do not block. The accessiBe cdn.acsbapp.com connect failure is unchanged.

Made with Cursor