# Not possible to embed player in Extension (despite CSP)

**URL:** <https://discuss.dev.twitch.com/t/not-possible-to-embed-player-in-extension-despite-csp/26192>\
**Category:** Extensions\
**Created:** [June 10, 2020, 7:09am UTC](https://discuss.dev.twitch.com/t/not-possible-to-embed-player-in-extension-despite-csp/26192 "2020-06-10T07:09:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![someuser](https://avatars.discourse-cdn.com/v4/letter/s/4bbf92/32.png) [@someuser](https://discuss.dev.twitch.com/u/someuser)\
**Post date:** [June 10, 2020, 7:09am UTC](https://discuss.dev.twitch.com/t/not-possible-to-embed-player-in-extension-despite-csp/26192/1 "2020-06-10T07:09:26Z")

</div>

Hey there,

Hope you can help me out. **I want to embed an Twitch Player (Live) for my extension** (without iframe, but with **object** ).

My first review gave me some hint:

> Please ensure your extension is adhering to our Content Security Policies listed here: [Life Cycle Management | Twitch Developers](https://dev.twitch.tv/docs/extensions/life-cycle#asset-hosting)

Due to #Announcements and Life Cycle Management I had an issue with embed Twitch Player as an extension (its not an iframe!). In the **Content Security Policy (CSP)** paragraph exists an part of:

> (…)  
> **frame-ancestors** [https://supervisor.ext-twitch.tv](https://supervisor.ext-twitch.tv) [https://extension-files.twitch.tv](https://extension-files.twitch.tv) \*\*https://`_`.twitch.tv** https://`_`.twitch.tech https://localhost.twitch.tv:`_` https://localhost.twitch.tech:`_` http://localhost.rig.twitch.tv:`\*`;  
> (…)

So I expected to embed a Twitch Player as video overlay like this, because “object” is also an frame-ancestors:  
`<object data="https://player.twitch.tv/?channel=bytethinks&parent=twitch.tv"></object>`

It works fine in the Twitch Developer Rig, so I comit this to review. At the review test streaming page from Twitch, the code does not work – against my expectations I got an error:

_Refused to load [Twitch](https://player.twitch.tv/?channel=bytethinks&parent=twitch.tv) because it appears in neither the object-src directive nor the default-src directive of the Content Security Policy._

**What I’m doing wrong? Or better: How can I make this work?**

Thanks! 🙂!

---

<div class="post-metadata">

**Author:** ![Dist](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dist/32/7192_2.png) [@Dist](https://discuss.dev.twitch.com/u/Dist)\
**Post date:** [June 10, 2020, 8:22am UTC](https://discuss.dev.twitch.com/t/not-possible-to-embed-player-in-extension-despite-csp/26192/2 "2020-06-10T08:22:20Z")

</div>

> **[Extensions Guidelines & Policies](https://dev.twitch.tv/docs/extensions/guidelines-and-policies/)**
>
> Extensions Guidelines and Policies

> [@](#):
>
> 2.2 Extensions may not use iframes.

You can’t use embeds in an extension.

> [@someuser](#):
>
> It works fine in the Twitch Developer Rig, so I comit this to review. At the review test streaming page from Twitch, the code does not work – against my expectations I got an error:

The dev rig doesn’t simulate all of the restrictions that are enforced on Twitch. You should always test on Twitch itself before submitting to review. In this case, embedding a Twitch Player will not work within an extension.