Content Security Policy doesn't support Android WebView

[jamesjryan]

Expected Behavior

No console error when using Vimeo iframe embed within an Android WebView.

Actual Behavior

Following error emitted to console

Refused to load the image 'android-webview-video-poster:default_video_poster/6354645963173012674' because it violates the following Content Security Policy directive: "img-src 'self' data: https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://player.vimeo.com https://*.ci.vimeows.com https://f.vimeocdn.com".

Steps to Reproduce

Can be reproduced using this URL

https://player.vimeo.com/video/214612739?autoplay=1&fullscreen=0&loop=1&autopause=0&muted=1&quality=1080p&playsinline=0

Note - requires the URL to be loaded within an Android WebView

This cannot be reproduced within a CodePen - here are some good steps for a "Hello world" style WebView to reproduce.

[fisherinnovation]

Please see https://stackoverflow.com/a/40412110/289798 for a solution to this issue.