Skip to content
Header Hawk

worker-src

worker-src specifies valid sources for Worker, SharedWorker and ServiceWorker scripts.

Its fallback chain is the longest in CSP - worker-src → child-src → script-src → default-src - which is why a worker can be blocked by a policy that never mentions workers.

Syntax

Section titled “Syntax”
Content-Security-Policy: worker-src 'none';
Content-Security-Policy: worker-src <source-expression-list>;

What it controls

Section titled “What it controls”
  • new Worker(url).
  • new SharedWorker(url).
  • navigator.serviceWorker.register(url).

Fallback

Section titled “Fallback”

If worker-src is absent, the browser consults child-src, and then script-src, then default-src. The full chain is worker-src → child-src → script-src → default-src.

Section titled “Recommended value”
Content-Security-Policy: worker-src 'self' blob:
  • Bundlers routinely construct workers from a Blob, and blob: is not covered by 'self'. If your build does not do that, drop it.
  • A service worker must be same-origin anyway, so 'self' is rarely a constraint in practice - the violations you see here are almost always bundler-generated blob: workers.

Examples

Section titled “Examples”

Allowed

Section titled “Allowed”

Under worker-src 'self' blob::

const url = URL.createObjectURL(new Blob([src], { type: "text/javascript" }));
new Worker(url);

Blocked

Section titled “Blocked”

Under worker-src 'self':

new Worker("data:text/javascript,postMessage(1)");

Browser support

Section titled “Browser support”
  • Widely available across browsers since May 2022.
  • Before worker-src was available, workers were governed by child-src and then script-src. A policy that must support old browsers needs the fallbacks to agree with it.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective worker-src
effectiveDirective worker-src
blockedUri blob, https://cdn.example.com/worker.js, data
Issue title worker-src blob: URI
  • blockedUri: "blob" is the common case and groups into one issue per directive. It is a policy decision, not a bug hunt: either blob: belongs in worker-src or the bundler should emit a real file.
  • Service worker registration failures show up here with a same-origin URL, which usually means the fallback chain reached a script-src that does not include 'self'.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.