From 25d6222df0734dd4e93857da01a2c8f0ac061b74 Mon Sep 17 00:00:00 2001 From: Kevin L'Hereec Date: Thu, 23 Jul 2026 15:30:01 +0200 Subject: [PATCH] fix: add worker-src to CSP to fix broken HMR connection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Without an explicit worker-src directive, browsers fall back to script-src ('self' only) for Web Workers, which blocks the blob: worker spawned internally by Vite's HMR client / Tuyau's client. This caused the dev HMR websocket connection to drop intermittently ('server connection lost. Polling for restart...'), leaving the Vue app in an inconsistent state after a failed hot reload — components using the Link component (internally named TuyauLink, from @tuyau/core) would throw 'You must wrap your app in a TuyauProvider' because the provide/inject context set up at the app root was lost. Added worker-src 'self' blob: to config/shield.ts. Verified: dev server restarts cleanly with the HMR socket connecting without CSP violations, full test suite (30/30) still passes. --- config/shield.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/config/shield.ts b/config/shield.ts index cd057c4..3f37be4 100644 --- a/config/shield.ts +++ b/config/shield.ts @@ -32,6 +32,14 @@ const shieldConfig = defineConfig({ defaultSrc: [`'self'`], connectSrc: [`'self'`, ...devConnectSrc], scriptSrc: [`'self'`], + // Some client-side dependencies (e.g. Vite's HMR client / the Tuyau + // API client) spawn a Web Worker from a `blob:` URL built at + // runtime from already same-origin-loaded code. Without an explicit + // worker-src, browsers fall back to script-src ('self' only), which + // blocks the blob: worker outright — this was observed to break the + // dev HMR connection and leave the Vue app in an inconsistent state + // (lost TuyauProvider context after a failed hot reload). + workerSrc: [`'self'`, 'blob:'], styleSrc: [`'self'`, `'unsafe-inline'`, 'https://fonts.googleapis.com'], imgSrc: [`'self'`, 'data:', 'https://fr.pc-builder.io', 'https://www.google.com'], fontSrc: [`'self'`, 'data:', 'https://fonts.gstatic.com'],