mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-06-18 23:39:11 +08:00
e7ce1e219e
The media-optimization worker is launched from a same-origin blob:
bootstrap that imports the real worker chunk by absolute URL. When
assets are served from a CDN, that import is fetched with a worker
destination and is therefore checked against worker-src (not
script-src), so strict-dynamic does not apply. With only `'self' blob:`,
the cross-origin CDN import is blocked:
```
Creating a worker from 'https://cdn/assets/.../entrypoint.digested.js' violates the following Content Security Policy directive: "worker-src 'self' blob:".
```
To fix, we add the asset host to worker-src so the worker chunk can be
imported on CDN/S3 deployments. Non-CDN deployments are unchanged
('self' blob:).
Unfortunately strict-dynamic is not consistently supported in
worker-src.
Followup to
|
||
|---|---|---|
| .. | ||
| builder.rb | ||
| default.rb | ||
| extension.rb | ||
| middleware.rb | ||
