fix

app/models/communication/website/with_security.rb

@@ -34,7 +34,7 @@ module Communication::Website::WithSecurity
     blocks.where(template_kind: :video).each do |block|
       video_url = block.template.url
       next unless video_url.present?
-      list << Video::Provider.find(video_url).csp_domain
+      list.concat Video::Provider.find(video_url).csp_domains
     end
     list
   end

app/services/video/provider/dailymotion.rb

@@ -6,6 +6,10 @@ class Video::Provider::Dailymotion < Video::Provider::Default
                                   : video_url.split('video/').last
   end
 
+  def csp_domains
+    DOMAINS
+  end
+
   # https://www.dailymotion.com/thumbnail/video/x8lyp39
   def poster
     "https://www.dailymotion.com/thumbnail/video/#{identifier}"

app/services/video/provider/default.rb

@@ -17,14 +17,18 @@ class Video::Provider::Default
     video_url
   end
 
-  def csp_domain
-    URI.parse(iframe_url).host
+  def csp_domains
+    [video_host]
   end
 
   def identifier
     ''
   end
 
+  def video_host
+    URI.parse(iframe_url).host
+  end
+
   def poster
     ''
   end

app/services/video/provider/vimeo.rb

@@ -5,6 +5,10 @@ class Video::Provider::Vimeo < Video::Provider::Default
     video_url.chomp('/').split('/').last
   end
 
+  def csp_domains
+    DOMAINS
+  end
+
   # https://vumbnail.com/621585396.jpg
   def poster
     "https://vumbnail.com/#{identifier}.jpg"

app/services/video/provider/youtube.rb

 class Video::Provider::Youtube < Video::Provider::Default
-  DOMAINS = ['youtube.com', 'youtu.be']
+  DOMAINS = [
+    'youtube.com', 
+    'www.youtube.com', 
+    'img.youtube.com', 
+    'youtu.be', 
+  ]
 
   def identifier
     video_url.include?('youtu.be')  ? video_url.split('youtu.be/').last
                                     : video_url.split('v=').last
   end
 
+  def csp_domains
+    DOMAINS
+  end
+
   # https://img.youtube.com/vi/XEEUOiTgJL0/hqdefault.jpg
   def poster
     "https://img.youtube.com/vi/#{identifier}/hqdefault.jpg"