Skip to content

Enable 'self' in Content-Security-Policy worker-src directive

Stan Hu requested to merge sh-csp-worker-self-src into master

What does this MR do and why?

In GitLab development, Vite appears to load workers from the GitLab origin. Add 'self' to allow those requests.

This originally was discovered in !147366 (comment 1822665318).

How to set up and validate locally

  1. Check out this branch.
  2. With the Network inspector open, visit a project page.
  3. Verify that the Content-Security-Policy header contains 'self' for worker-src.
Edited by Stan Hu

Merge request reports