From bab370ae874e2aa910b27757f92e746501a92b96 Mon Sep 17 00:00:00 2001 From: Alex Gleason Date: Thu, 28 May 2026 06:38:05 -0500 Subject: [PATCH] Allow blob: workers in CSP so QR scanner can decode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The qr-scanner library spins up its ZXing decoder inside a Web Worker created from a blob URL. Our CSP allowed scripts and connections but not workers, so the browser silently blocked worker creation — the camera opened fine (media-src is permissive) but no frame was ever decoded, leaving the user pointed at a QR code that never registered. Add 'worker-src self blob:' and 'child-src self blob:' (the latter covers older browsers that fall back to child-src for worker policy) to match the directives Ditto already ships. Regression-of: bae49e61 --- index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.html b/index.html index e6b45bec..ab87fe91 100644 --- a/index.html +++ b/index.html @@ -23,7 +23,7 @@ - +