getting error content-security-policy error: refused to create worker

user_13890010 0
Viewed 1146

In my angular project. I'm getting below mentioned error

refused to create a worker from 'blob:http://localhost:4200/d8633b89-9f70-4fd6-b08a-e369ccd34273' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' https://cdn.jsdelivr.net/npm/pdfjs-dist@2.5.207/es5/build/pdf.worker.js". Note that 'worker-src' was not explicitly set, so 'script-src' is used as a fallback.

I know its related Content security policy. I have set up CSP. Here it is

default-src 'self';
script-src 'self' 'unsafe-eval' https://cdn.jsdelivr.net/npm/pdfjs-dist@2.5.207/es5/build/pdf.worker.js;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
img-src 'self' data: https://*.amazonaws.com;
media-src 'self' data: https://*.amazonaws.com;
connect-src 'self' http://localhost:* ws://localhost:*;
font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com data:;
childSrc blob
worker-src blob:

but I'm still getting error.

angular mozilla firefox google-chrome javascript
1 Answers

I believe the semicolons were missing to separate the font-src, child-src (I suppose childSrc is not correct) and worker-src

default-src 'self';
script-src 'self' 'unsafe-eval' https://cdn.jsdelivr.net/npm/pdfjs-dist@2.5.207/es5/build/pdf.worker.js;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
img-src 'self' data: https://*.amazonaws.com;
media-src 'self' data: https://*.amazonaws.com;
connect-src 'self' http://localhost:* ws://localhost:*;
font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com data:;
child-src blob:;
worker-src blob:;
user_3901610
Related