Content-Security-Policy: upgrade-insecure-requests; default-src 'self' https://*.apple.com; img-src 'self' https://*.apple.com https://*.mzstatic.com data: blob: artwork:; style-src 'self' https://*.apple.com 'unsafe-inline'; script-src 'self' https://*.apple.com 'unsafe-eval'; connect-src 'self' https://*.apple.com https://*.mzstatic.com https://mediaservices.cdn-apple.com https://*.push.apple.com wss://*.push.apple.com; media-src 'self' https: http: blob:; child-src 'self' https://*.apple.com musics: blob: itms: itmss: itms-podcasts: itms-podcast: podcast: podcasts:; frame-ancestors 'none'; report-uri /api/csp-report