TYPO3 Core

The YouTubeRenderer has the option enablejsapi that allows script access on the embedded Youtube video.

That is a feature provided by Youtube, which is documented here: https://developers.google.com/youtube/player_parameters#origin
As recommended the YouTubeRenderer sets the origin parameter, but it only contains the host name while in Youtube examples origin also contains the request scheme.

For me accessing the video only works when the origin is provided with request scheme.

<iframe id="ytplayer" type="text/html" width="640" height="390" src="https://www.youtube.com/embed/M7lc1UVf-VE?autoplay=1&origin=example.com" frameborder="0"></iframe>
=> script access doesn't work

<iframe id="ytplayer" type="text/html" width="640" height="390" src="https://www.youtube.com/embed/M7lc1UVf-VE?autoplay=1&origin=http://example.com" frameborder="0"></iframe>
=> script access works