Allow worker blob URLs in CSP directives

canvas-confetti creates web workers from blob URLs, which requires an explicit worker-src directive.
2026-03-13 15:01:28 +00:00
parent 9901f1177e
commit 854a6e1816
1 changed files with 1 additions and 0 deletions
@@ -19,6 +19,7 @@ defmodule MusicLibraryWeb.Router do
                "; style-src 'self' 'unsafe-inline' https://rsms.me#{@dev_origins}" <>
                "; font-src 'self' https://rsms.me" <>
                "; img-src 'self' data: blob: #{@img_origins}" <>
+                "; worker-src 'self' blob:" <>
                "; connect-src 'self'#{@dev_origins}" <>
                "; frame-ancestors 'self'" <>
                "; base-uri 'self'"