feat(csp): add worker-src directive for ALTCHA proof-of-work in admin CSP

2026-07-20 14:34:46 +03:30
parent a8d33ceeaf
commit 087683e877
3 changed files with 5 additions and 0 deletions
@@ -20,6 +20,9 @@ class AdminCspSubscriberTest extends WebTestCase
        self::assertStringContainsString("default-src 'self'", $csp);
        self::assertStringContainsString("object-src 'none'", $csp);
        self::assertStringContainsString("frame-ancestors 'none'", $csp);
+        // ALTCHA solves its proof-of-work inside blob: Web Workers; without this
+        // directive the login captcha errors out (worker-src falls back to script-src).
+        self::assertStringContainsString("worker-src 'self' blob:", $csp);
    }

    public function testNonAdminResponseDoesNotGetTheAdminCsp(): void