Default CSP has no worker-src directive; blocks MapLibre and any blob: Web Worker #93

Summary

SecurityHeadersMiddleware._DEFAULT_CSP (and the dev override in dev_csp(...)) doesn't set a worker-src directive, and CSP's fallback chain uses script-src for workers. Because script-src is 'self' 'unsafe-inline' 'unsafe-eval' (without blob:), every dependency that creates a Web Worker via URL.createObjectURL(blob) is blocked.

Repro

Mount any maplibre-gl map in a page rendered through the framework. The browser logs:

Refused to create a worker from 'blob:http://localhost:8001/<uuid>' because it
violates the following Content Security Policy directive: "script-src 'self'
'unsafe-inline' 'unsafe-eval' http://localhost:5051". Note that 'worker-src' was
not explicitly set, so 'script-src' is used as a fallback.

The map mounts but never paints (the worker handles tile decoding and source updates).

This isn't MapLibre-specific. Any library that ships a worker bundled as a blob (most modern WASM/canvas libs — comlink, web-tree-sitter, parquet-wasm, lighthouse-style, etc.) will hit the same wall.

Expected

The default CSP should add:

worker-src 'self' blob:
child-src 'self' blob:

(child-src is the legacy fallback some browser versions still consult before worker-src.)

blob: for workers is widely accepted as safe even in fairly strict CSPs — the bytes still come from same-origin code that already had script-execution privileges.

Workaround

from simple_module_hosting.middleware import SecurityHeadersMiddleware

_EXTRA = "worker-src 'self' blob:; child-src 'self' blob:"
SecurityHeadersMiddleware._DEFAULT_CSP = SecurityHeadersMiddleware._DEFAULT_CSP + "; " + _EXTRA
_orig_dev = SecurityHeadersMiddleware.dev_csp
SecurityHeadersMiddleware.dev_csp = staticmethod(
    lambda url: _orig_dev(url) + "; " + _EXTRA
)

Has to run before create_app(settings). Monkey-patching the framework's middleware class isn't a great pattern for app code.

Acceptance

• Loading a maplibre-gl map (or any blob-worker library) in an unmodified host scaffold renders without CSP violations.