The error that you're getting is $interpolate:noconcat
. It states:
Strict Contextual Escaping disallows interpolations that concatenate multiple expressions when a trusted value is required. Source.
This means that you must use $sce and mark the desired URL as trusted. This would fix your problem:
angular
.module('myApp', [])
.controller('MainCtrl', function($sce) {
this.youtubeLink = $sce.trustAsResourceUrl('https://www.youtube.com/embed/N4ony2r0QFs');
});
<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.5.3/angular.min.js"></script>
<div ng-app="myApp" ng-controller="MainCtrl as vm">
<iframe width="560" height="315" ng-src="{{ vm.youtubeLink }}" frameborder="0" allowfullscreen></iframe>
</div>
Another way, as stated in this answer, would be to create a custom filter which is specifically built to trust youtube URLs:
.filter('youtubeEmbedUrl', function ($sce) {
return function(videoId) {
return $sce.trustAsResourceUrl('https://www.youtube.com/embed/' + videoId);
};
});
You'd be using this filter anytime you want to embed a video, like this: ng-src="{{ vm.youtubeLink | youtubeEmbedUrl }}"
.