CSP blob: WordPress
-
Does latest version of WordPress by default requires:
worker-src ‘self’ blob:
to be permitted on Content Security Policy?
Previously, my content security policy was:
Content-Security-Policy “default-src ‘self’ https: data: ‘unsafe-inline’ ‘unsafe-eval'”
Now, I have to keep the following on my web server to remove error at WordPress Admin shown on the browser console:
Content-Security-Policy “default-src ‘self’ https: data: ‘unsafe-inline’ ‘unsafe-eval’; worker-src ‘self’ blob:”
The error on the browser console says:
wp-admin/:84 Refused to create a worker from 'blob:https://mydomain.com/51238748-89eb-4184-9aaa-4d53bfb5e2ca' because it violates the following Content Security Policy directive: "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval'". Note that 'worker-src' was not explicitly set, so 'default-src' is used as a fallback.I have confirmed that this error has appeared from WordPress core itself by deactivating all the plugins and switching to Twenty Twenty-Five theme.
The topic ‘CSP blob: WordPress’ is closed to new replies.