RockiRider / csp

A vite plugin for your content security policy
https://vite-csp.tsotne.co.uk/
GNU General Public License v3.0
9 stars 0 forks source link

Don't quote "blob:" in CSP #37

Closed jtbandes closed 1 month ago

jtbandes commented 2 months ago

Hi, thanks for creating this plugin. I ran into a problem using it and loading a worker from a blob: url. I think this line is incorrect:

https://github.com/RockiRider/csp/blob/aa1ea7abb82e28afafbe0f7bfb1138a4031d0c82/packages/vite-plugin-csp-guard/src/policy/createPolicy.ts#L12

According to https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#scheme-source blob: should not be surrounded in quotes.