If you use Varnish:

sub vcl_backend_response {
if (bereq.url ~ "^/proxy/") {
set beresp.http.Content-Security-Policy = "sandbox";
}
}


Also clear your MediaProxy cache, because serving the cached variant will have the old header without the CSP rule