HeaderAudit

CSP worker-src

Where Worker, SharedWorker and ServiceWorker scripts may come from.

Falls back to
child-src, then script-src, then default-src
Group
Fetch directives

Detail

Workers execute script, so a permissive value here reopens what script-src closes. blob: is frequently required by bundlers that construct workers at runtime, and is also the usual way an attacker would try to run code, so grant it only if a build genuinely needs it.

Example

worker-src 'self'

Analyse a full policy → · Generate one →