which URLs need to be whitelisted in $wgCSPHeader 'default-src' to still allow youtube embeds? I tried 'youtube.com' 'www.youtube.com' '*.youtube.com' 'youtu.be' to no avail. (videos work fine when CSP is disabled)
Topic on Extension talk:YouTube
spamfilter doesn't let me post the link that worked :P
you need https and www. and it's youtube-nocookie.com followed by /embed/ (even the trailing / is needed)