Content-Security-Policy: default-src 'self' https://*.apple.com; img-src 'self' https://*.apple.com https://*.mzstatic.com artwork: data: blob:; style-src 'self' https://*.apple.com 'unsafe-inline'; script-src 'self' https://*.apple.com 'unsafe-eval'; connect-src 'self' https://*.apple.com https://*.mzstatic.com https://mediaservices.cdn-apple.com https://*.push.apple.com wss://*.push.apple.com; media-src 'self' https://* blob:; child-src 'self' https://*.apple.com musics: blob: itms: itmss: itms-podcasts: itms-podcast: podcast: podcasts:; frame-ancestors 'none'; block-all-mixed-content;