Skip to content

Sentry default Content Security Policy sets worker-src 'none' instead of worker-src 'self' #127953

Closed
Closed
Sentry default Content Security Policy sets worker-src 'none' instead of worker-src 'self'#127953

Description

@TommyTran732
TommyTran732
opened on Oct 18, 2026

Environment

self-hosted (https://develop.sentry.dev/self-hosted/)

Steps to Reproduce

  • Set CSP_REPORT_ONLY to False
  • Observe that the internal project reports
SecurityError: Failed to register a ServiceWorker: The provided scriptURL ('https://sentry.yourdomain.tld/service-worker.js`) violates the Security Content Policy.

Expected Result

There would be no error and worker-src is set to self.

Actual Result

The application sets worker-src to none.

Product Area

Other

Link

No response

DSN

No response

Version

26.8.0

Activity

  1. getsantry commented on Oct 18, 2026

    @getsantry
    getsantryBot
    on Oct 18, 2026
    Contributor

    Assigning to @getsentry/support for routing ⏲️

  2. linear-code commented on Oct 18, 2026

    @linear-code
    linear-codeBot
    on Oct 18, 2026 – with Linear Code

    ENG-8836

  3. getsantry
    added
    Waiting for: Support
    on Oct 18, 2026
  4. getsantry
    added this to GitHub Issues with 👀 3on Oct 18, 2026
  5. getsantry
    moved this to Waiting for: Support in GitHub Issues with 👀 3on Oct 18, 2026
  6. TommyTran732
    changed the title [-]Sentry default Content Security Policy does not set worker-src[/-] [+]Sentry default Content Security Policy sets `worker-src 'none'` instead of `worker-src 'self'`[/+] on Oct 18, 2026

  7. GemTails commented on Oct 18, 2026

    @GemTails
    GemTails
    on Oct 18, 2026

    #125307
    This pull request should have already updated the default from 'none' to 'self'. Perhaps the pull request has not yet been pushed to prod, or the current environment is outdated.

  8. TommyTran732 commented on Oct 18, 2026

    @TommyTran732
    TommyTran732
    on Oct 18, 2026
    Author

    I see, perhaps it's because I am on 26.8.0 instead of 26.9.0. 26.9.0 threw so many errors with cron and whatnot that I had to roll back to 26.8.0 😢

  9. oioki commented on Oct 19, 2026

    @oioki
    oioki
    on Oct 19, 2026
    Member

    Indeed, this was resolved in #125307 and available in 26.10.0.

    As a workaround, you can set the same in your sentry.conf.py:

    CSP_WORKER_SRC = [
    "'self'",  # service worker
    "blob:",  # session replay workers
]
  10. oioki
    closed this as completedon Oct 19, 2026
  11. getsantry
    removed
    Waiting for: Support
    on Oct 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions