I have been trying to move my site to hash-source CSP instead of host-source CSP to verify integrity of files distributed by a CDN.

I have a WebWorker running in the background, which imports a few scripts from a CDN via the importScripts() function. When I specify the hash of the script, for example, for jQuery, script-src: 'sha384-tsQFqpEReu7ZLhBV2VZlAu7zcOV+rXbYlF2cqB8txI/8aZajjp4Bqd+V6D5IgvKT', I get a CSP violation error. However, when I include the script via HTML tags, everything is fine, so the hash is correct.

What makes this even stranger is that when I add a host-source CSP, for example, script-src: https://cdnjs.cloudflare.com, no errors appear and the WebWorker script runs just fine.

How do I make hash-source CSP work with WebWorkers, or at least verify integrity of imported files with the WebWorker API?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.