Directive: worker src

Overview

The worker-src directive specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.

Affects: Web Workers — Worker, SharedWorker, and ServiceWorker

Required reading:

• Can I use worker-src?
• MDN Web Docs reference
• Using web workers with CSP

Usage examples

Accepts one or more schemes or hosts, the 'self' keyword, or the 'none' keyword.

worker-src 'none'

worker-src 'self'

worker-src example.com

worker-src example.com example.org

worker-src https://*.example.com

worker-src https:

Fallbacks

✅ worker-src will fallback to child-src, which will fallback to script-src, which will fallback to default-src if it is undefined. Except for Chromium browsers, which will skip the child-src stage.

• default-src
  • script-src
    • child-src ← Chromium skips this
      • worker-src

Possible errors

[ERROR] directive worker-src has an invalid value

See CSP-0100 for an explanation of this issue.

For developers

ABNF (CSP3)

directive-name  = "worker-src"
directive-value = serialized-source-list

See ABNF: serialized-source-list

Type

• source-list in CSP2
• serialized-source-list in CSP3

References

• CSP Level 2 reference
• CSP Level 3 reference
• MDN Web Docs reference
• Using web workers with CSP
• Can I use worker-src?