CSP: worker-src
Baseline Widely available
This feature is well established and works across many devices and browser versions. It’s been available across browsers since May 2022.
HTTP Content-Security-Policy（内容安全策略，CSP）中的 worker-src 指令指定了 Worker、SharedWorker 或 ServiceWorker 脚本的有效来源。
| CSP 版本 | 3 |
|---|---|
| 指令类型 | fetch 指令 |
| 回落 |
如果这个指令不存在，则用户代理在管理 worker 执行时，将首先查找 |
语法
worker-src 策略可以允许一个或者多个源：
http
Content-Security-Policy: worker-src <source>;
Content-Security-Policy: worker-src <source> <source>;
源
示例
违规的案例
给定此 CSP 标头：
http
Content-Security-Policy: worker-src https://example.com/
Worker、SharedWorker、ServiceWorker 被阻止，无法加载。
html
<script>
let blockedWorker = new Worker("data:application/javascript,…");
blockedWorker = new SharedWorker("https://not-example.com/");
navigator.serviceWorker.register("https://not-example.com/sw.js");
</script>
规范
| Specification |
|---|
| Content Security Policy Level 3 # directive-worker-src |