feat(csp): add worker-src directive for ALTCHA proof-of-work in admin CSP

2026-07-20 14:34:46 +03:30
parent a8d33ceeaf
commit 087683e877
3 changed files with 5 additions and 0 deletions
@@ -38,6 +38,7 @@ final class AdminCspSubscriber implements EventSubscriberInterface
            'Content-Security-Policy',
            "default-src 'self'; "
            . "script-src 'self'; "
+            . "worker-src 'self' blob:; "            // ALTCHA proof-of-work solver runs in blob: Web Workers
            . "style-src 'self' 'unsafe-inline'; "   // Tailwind / CKEditor inline styles
            . "img-src 'self' data: blob:; "
            . "font-src 'self' data:; "