From a04e2ddeca47b8e9827faf8d7aea5ee698c23f23 Mon Sep 17 00:00:00 2001
From: Lorenzo Montanari <l0ll098@users.noreply.github.com>
Date: Wed, 15 Jul 2026 12:49:18 +0200
Subject: [PATCH] fix(server): updated default CSP config to support videos
 from V3 player (#29830)

---
 server/helmet.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/helmet.json b/server/helmet.json
index 1cd301d813..29b74d2244 100644
--- a/server/helmet.json
+++ b/server/helmet.json
@@ -5,6 +5,7 @@
       "script-src": ["'self'", "'wasm-unsafe-eval'", "'unsafe-inline'", "https://www.gstatic.com"],
       "style-src": ["'self'", "'unsafe-inline'"],
       "img-src": ["'self'", "data:", "blob:"],
+      "media-src": ["'self'", "data:", "blob:"],
       "connect-src": [
         "'self'",
         "blob:",