I have been trying to move my site to hash-source CSP instead of host-source CSP to verify integrity of files distributed by a CDN.
I have a WebWorker running in the background, which imports a few scripts from a CDN via the importScripts() function. When I specify the hash of the script, for example, for jQuery,
script-src: 'sha384-tsQFqpEReu7ZLhBV2VZlAu7zcOV+rXbYlF2cqB8txI/8aZajjp4Bqd+V6D5IgvKT', I get a CSP violation error. However, when I include the script via HTML tags, everything is fine, so the hash is correct.
What makes this even stranger is that when I add a host-source CSP, for example,
script-src: https://cdnjs.cloudflare.com, no errors appear and the WebWorker script runs just fine.
How do I make hash-source CSP work with WebWorkers, or at least verify integrity of imported files with the WebWorker API?