Chrome throws error for blob
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 25.9k
- Forks
- 2.4k
- Avg merge
- 13h 10m
- Merged PRs (30d)
- 4
Description
Failed to construct 'Worker': Access to the script at 'blob:https://OUR_URL_HERE/726e7465-58ee-4c4e-9f9f-2a21ce5966a3' is denied by the document's Content Security Policy.
This error is thrown when trying to access our page on chrome/chromium-based browsers. We want to avoid changing our CSP since blobs can be an XSS risk.
Also since it works fine on Firefox, IE and Edge, without changing the CSP, we'd like to fix this problem without changing the CSP because a browser doesn't like it.
I have seen an Issue before regarding this but it was closed by adding a disableSearch. It seems this might be a different problem.
Best regards and please help.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the Worker construction failure in Chrome or Chromium with the reported Content Security Policy, then trace the code path that creates the Worker and compare it with Firefox, IE, and Edge behavior. Check the earlier issue involving disableSearch for related context. Done means the page works in Chromium without weakening the CSP.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100