From 854a6e18164e4325beb09d91f14a18fd026d4532 Mon Sep 17 00:00:00 2001
From: Claudio Ortolina <cloud8421@gmail.com>
Date: Fri, 13 Mar 2026 15:01:28 +0000
Subject: [PATCH] Allow worker blob URLs in CSP directives

canvas-confetti creates web workers from blob URLs,
which requires an explicit worker-src directive.
---
 lib/music_library_web/router.ex | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/music_library_web/router.ex b/lib/music_library_web/router.ex
index f56a0e27..663090e5 100644
--- a/lib/music_library_web/router.ex
+++ b/lib/music_library_web/router.ex
@@ -19,6 +19,7 @@ defmodule MusicLibraryWeb.Router do
                 "; style-src 'self' 'unsafe-inline' https://rsms.me#{@dev_origins}" <>
                 "; font-src 'self' https://rsms.me" <>
                 "; img-src 'self' data: blob: #{@img_origins}" <>
+                "; worker-src 'self' blob:" <>
                 "; connect-src 'self'#{@dev_origins}" <>
                 "; frame-ancestors 'self'" <>
                 "; base-uri 'self'"