CSP - use child-src, worker-src

[jrieken]

We have a CSP that defines script-src. Chrome/Edge applies that to workers/iframes while Safari doesn't:

[Error] Refused to load http://localhost:9777/static/out/vs/base/worker/workerMain.js#editorWorkerService because it appears in neither the child-src directive nor the default-src directive of the Content Security Policy.

It looks like it wants the child-src directive which after looking at the spec seems actually correct. Tho, we should also try the worker-src directive

[jrieken]

@mjbvz Any other insides given you have more CSP knowledge?

[mjbvz]

For workers, try worker-src first. It is the most modern way of specifying a CSP for workers and Chrome will prefer it over child-src and script-src

We currently use frame-src for iframes which should be good (at one point it was supposed to be deprecated but I don't think this happened)

[jrieken]

Yeah, seems like [worker|frame]-src is the future. FF prints a warning when using child-src, safari prints a warning when using worker-src... 🤷‍♂ I will add both to make them all happy...