Content-Security-Policy: frame-ancestors 'self';

Content-Security-Policy-Report-Only: style-src https://fonts.googleapis.com/ 'unsafe-inline' 'self' https://www1.amexnetwork.com/; block-all-mixed-content ; script-src https://*.americanexpress.com/ https://www.gstatic.com/ 'unsafe-inline' 'self' https://maps.googleapis.com/ https://static.doubleclick.net/ https://www1.amexnetwork.com/ https://c.evidon.com/ https://www.google.com/ https://www.youtube.com/ https://ds-aksb-a.akamaihd.net/ 'unsafe-eval'; base-uri 'self'; form-action 'self' https://*.americanexpress.com/; frame-src https://sso.americanexpress.com/ https://www.youtube.com/ 'self' https://www.payback.it/; img-src 'self' data: https:; connect-src https://sso.americanexpress.com/ https://ds-aksb-a.akamaihd.net/ 'self' https://*.evidon.com/; object-src 'self'; worker-src 'none'; media-src 'self'; frame-ancestors 'none'; font-src http://fonts.gstatic.com/ https://www.aexp-static.com/ https://fonts.gstatic.com/ 'self';