urlscan.io logo urlscan.io
SecurityTrails logo

login.fifa.org Open in urlscan Pro
3.125.118.61  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://fti.fifa.org/
Effective URL: https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2I...
Submission: On November 15 via manual from MY — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 1 domains to perform 7 HTTP transactions. The main IP is 3.125.118.61, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is login.fifa.org.
TLS certificate: Issued by R3 on October 15th 2023. Valid for: 3 months.
This is the only time login.fifa.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 152.199.22.39 15133 (EDGECAST)
7 3.125.118.61 16509 (AMAZON-02)
7 1
Apex Domain
Subdomains		 Transfer
8 fifa.org
fti.fifa.org
login.fifa.org
616 KB
7 1
Domain Requested by
7 login.fifa.org login.fifa.org
1 fti.fifa.org 1 redirects
7 2

This site contains no links.

Subject Issuer Validity Valid
login.fifa.org
R3		 2023-10-15 -
2024-01-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SKO9r0W8mjaX50xZb1g5kk8ggJx1&wa=wsignin1.0
Frame ID: ABBE397DE28FF498604417B039E3C874
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Single Sign On

Page URL History Show full URLs

  1. https://fti.fifa.org/ HTTP 302
    https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlY... Page URL

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

2
Countries

615 kB
Transfer

611 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://fti.fifa.org/ HTTP 302
    https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SKO9r0W8mjaX50xZb1g5kk8ggJx1&wa=wsignin1.0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request prp.wsf
login.fifa.org/idp/
Redirect Chain
  • https://fti.fifa.org/
  • https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SK...
6 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SKO9r0W8mjaX50xZb1g5kk8ggJx1&wa=wsignin1.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.125.118.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-125-118-61.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0006b8daac668ab1edfe2f8baab0ebf07ad771901802d5e3cd9054f5d8844cdc
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, no-store
content-length
6450
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
content-type
text/html;charset=utf-8
date
Wed, 15 Nov 2023 01:21:57 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
x-xss-protection
1; mode=block

Redirect headers

access-control-allow-origin
*
cache-control
private
content-length
0
date
Wed, 15 Nov 2023 01:21:56 GMT
location
https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SKO9r0W8mjaX50xZb1g5kk8ggJx1&wa=wsignin1.0
referrer-policy
same-origin
server
Microsoft-IIS/8.5
strict-transport-security
max-age=63072000; includeSubDomains
x-aspnet-version
4.0.30319
x-aspnetmvc-version
5.2
x-content-type-options
nosniff
x-frame-options
sameorigin
x-powered-by
ASP.NET
x-xss-protection
1; mode=block
main.css
login.fifa.org/assets/css/ 		172 KB
172 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.fifa.org/assets/css/main.css
Requested by
Host: login.fifa.org
URL: https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SKO9r0W8mjaX50xZb1g5kk8ggJx1&wa=wsignin1.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.125.118.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-125-118-61.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
2e7c19b321ae3fb7a67c0aa625fb4d7adf794ff43e4103810552d183bd0f8031
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SKO9r0W8mjaX50xZb1g5kk8ggJx1&wa=wsignin1.0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Wed, 15 Nov 2023 01:21:57 GMT
strict-transport-security
max-age=15724800; includeSubDomains
referrer-policy
strict-origin-when-cross-origin
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
last-modified
Sat, 04 Nov 2023 10:25:25 GMT
x-content-type-options
nosniff
content-type
text/css
cache-control
max-age=0, must-revalidate
content-length
175750
x-xss-protection
1; mode=block
pf-general.js
login.fifa.org/assets/scripts/ 		4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login.fifa.org/assets/scripts/pf-general.js
Requested by
Host: login.fifa.org
URL: https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SKO9r0W8mjaX50xZb1g5kk8ggJx1&wa=wsignin1.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.125.118.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-125-118-61.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
48e71014aec845a64765f0ade454fc1f0d20c43d2b0c97249ad6cef4b99ea6e2
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SKO9r0W8mjaX50xZb1g5kk8ggJx1&wa=wsignin1.0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Wed, 15 Nov 2023 01:21:57 GMT
strict-transport-security
max-age=15724800; includeSubDomains
referrer-policy
strict-origin-when-cross-origin
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
last-modified
Sat, 04 Nov 2023 10:05:18 GMT
x-content-type-options
nosniff
content-type
application/javascript
cache-control
max-age=0, must-revalidate
content-length
3632
x-xss-protection
1; mode=block
fifa_logo_big.png
login.fifa.org/assets/images/fifa/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.fifa.org/assets/images/fifa/fifa_logo_big.png
Requested by
Host: login.fifa.org
URL: https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SKO9r0W8mjaX50xZb1g5kk8ggJx1&wa=wsignin1.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.125.118.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-125-118-61.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
95fcf5c664f24605268fc49fe3e85e1dd1d0f470a4d3878b9e8bae3975464844
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.fifa.org/idp/prp.wsf?wtrealm=https%3a%2f%2ffti.fifa.org%2f&wctx=WsFedOwinState%3dbJlYSMfiYeypDCbUkSDdTI2IWjR2edfgmz04n3xeGTvfAMKOzGEe_q0RtUfZAOPNg7qM3bHT17I3x4PBG8VhPvRyamIyhCfwnj_0SKO9r0W8mjaX50xZb1g5kk8ggJx1&wa=wsignin1.0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Wed, 15 Nov 2023 01:21:57 GMT
strict-transport-security
max-age=15724800; includeSubDomains
referrer-policy
strict-origin-when-cross-origin
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
last-modified
Sat, 04 Nov 2023 10:05:18 GMT
x-content-type-options
nosniff
content-type
image/png
cache-control
max-age=0, must-revalidate
content-length
24306
x-xss-protection
1; mode=block
pitch_grass_bg.jpg
login.fifa.org/assets/images/fifa/ 		283 KB
283 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.fifa.org/assets/images/fifa/pitch_grass_bg.jpg
Requested by
Host: login.fifa.org
URL: https://login.fifa.org/assets/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.125.118.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-125-118-61.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
ada86eed57563827a3fa23344c8261cc58c0dd2fd04afbece8c048990c997511
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.fifa.org/assets/css/main.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Wed, 15 Nov 2023 01:21:57 GMT
strict-transport-security
max-age=15724800; includeSubDomains
referrer-policy
strict-origin-when-cross-origin
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
last-modified
Sat, 04 Nov 2023 10:05:18 GMT
x-content-type-options
nosniff
content-type
image/jpeg
cache-control
max-age=0, must-revalidate
content-length
289473
x-xss-protection
1; mode=block
ProximaNova-Light.otf
login.fifa.org/assets/fonts/proxima-nova/ 		61 KB
62 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://login.fifa.org/assets/fonts/proxima-nova/ProximaNova-Light.otf
Requested by
Host: login.fifa.org
URL: https://login.fifa.org/assets/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.125.118.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-125-118-61.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0f77660e06a5f61a45c4dbdab511722357cf29e7f5ba1b2cf097550afdb0ed20
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://login.fifa.org/assets/css/main.css
Origin
https://login.fifa.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Wed, 15 Nov 2023 01:21:57 GMT
strict-transport-security
max-age=15724800; includeSubDomains
referrer-policy
strict-origin-when-cross-origin
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
last-modified
Sat, 04 Nov 2023 10:05:18 GMT
x-content-type-options
nosniff
content-type
application/vnd.oasis.opendocument.formula-template
cache-control
max-age=0, must-revalidate
content-length
62968
x-xss-protection
1; mode=block
ProximaNova-Regular.otf
login.fifa.org/assets/fonts/proxima-nova/ 		61 KB
62 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://login.fifa.org/assets/fonts/proxima-nova/ProximaNova-Regular.otf
Requested by
Host: login.fifa.org
URL: https://login.fifa.org/assets/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.125.118.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-125-118-61.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://login.fifa.org/assets/css/main.css
Origin
https://login.fifa.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Wed, 15 Nov 2023 01:21:57 GMT
strict-transport-security
max-age=15724800; includeSubDomains
referrer-policy
strict-origin-when-cross-origin
content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
last-modified
Sat, 04 Nov 2023 10:05:18 GMT
x-content-type-options
nosniff
content-type
application/vnd.oasis.opendocument.formula-template
cache-control
max-age=0, must-revalidate
content-length
62892
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| getScreenWidth function| isMobile function| setMobile function| toggleMobile function| setFocus function| registerEventHandler function| registerEventHandlerForClass function| handleReturnPress function| handleReturnPressForClass function| toggleRequirementsDisplay function| revealPassword boolean| formSubmitted function| removeIdentifier function| showIdentifierInputBox function| showExistingAccounts function| selectIdentifier function| postOk function| postCancel function| submitForm

4 Cookies

Domain/Path Name / Value
login.fifa.org/assets/ Name: INGRESSCOOKIE
Value: 1700011318.16.30.767744|fb3dd5460ec1e160d9092e14b575dbcf
login.fifa.org/idp/ Name: INGRESSCOOKIE
Value: 1700011318.112.30.482239|fb3dd5460ec1e160d9092e14b575dbcf
login.fifa.org/ Name: PF
Value: ifzKD6iLOuZusAM04PingB
login.fifa.org/ Name: uule
Value: CvAcWmVUHTWglQAeHX3xAg==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; object-src 'self'; frame-ancestors 'self' https://*.azurewebsites.net https://*.mediahub.fifa.com https://*.fifatrainingcentre.com ;
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block