From 5d542a9391ebb189228da49df430e56a7cda2aa7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Wed, 25 Mar 2026 22:40:05 +0100 Subject: [PATCH] Fix CSP: allow blob: for Yjs web worker y-websocket creates a Web Worker from a blob URL. The CSP script-src needs blob: and an explicit worker-src directive to allow this. Co-Authored-By: Claude Opus 4.6 (1M context) --- infrastructure/Caddyfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/Caddyfile b/infrastructure/Caddyfile index f4a4fea..d5b27c8 100644 --- a/infrastructure/Caddyfile +++ b/infrastructure/Caddyfile @@ -5,7 +5,7 @@ X-Frame-Options "DENY" Referrer-Policy "strict-origin-when-cross-origin" Permissions-Policy "camera=(), microphone=(), geolocation=()" - Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.tile.openstreetmap.org; connect-src 'self' wss: https://*.sentry.io https://*.ingest.de.sentry.io; font-src 'self';" + Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.tile.openstreetmap.org; connect-src 'self' wss: https://*.sentry.io https://*.ingest.de.sentry.io; font-src 'self';" } }