CSP worker-src
Where Worker, SharedWorker and ServiceWorker scripts may come from.
- Falls back to
child-src, then script-src, then default-src- Group
- Fetch directives
Detail
Workers execute script, so a permissive value here reopens what script-src closes. blob: is frequently required by bundlers that construct workers at runtime, and is also the usual way an attacker would try to run code, so grant it only if a build genuinely needs it.
Example
worker-src 'self'