Content-Security-Policy: default-src 'self' data: blob: 'unsafe-eval' 'unsafe-inline' https://img.yec.tw https://*.yimg.com https://*.yahoo.com https://*.yahooapis.com https://ecshoppingwebview https://ecstorewebview https://ecauctionwebview https://*.google.com https://*.google.com.tw https://*.googleapis.com https://*.google-analytics.com https://www.googletagmanager.com https://bat.bing.com https://*.criteo.com https://*.criteo.net https://*.useinsider.com https://*.scupio.com https://*.aralego.com https://*.taboola.com https://*.youtube.com https://*.doubleclick.net https://*.facebook.net https://*.facebook.com https://*.creativecdn.com https://*.gstatic.com https://guce.oath.com https://*.amazonaws.com;frame-src 'self' https://img.yec.tw https://*.yimg.com https://*.yahoo.com https://*.tappaysdk.com https://*.google.com https://*.youtube.com https://*.criteo.com https://*.criteo.net https://*.useinsider.com https://*.scupio.com https://*.aralego.com https://*.taboola.com https://*.facebook.com https://*.creativecdn.com https://*.doubleclick.net;frame-ancestors 'self' https://*.yahoo.com;media-src https: data: blob:;font-src https: data: blob:;img-src https: data: blob:;object-src 'none';report-uri /report-violation