CSP worker-src doesn't match where workers are loaded from

[dbkr]

Steps to reproduce

For the develop deployment, our CSP in the meta tag has a worker-src of 'self' blob: https://element-web-develop.element.io;. This would suggest that it ought to be able to load workers from https://element-web-develop.element.io, however when #26698 happened, worker loads 301ed to a location on the above origin and then failed to load.

It may be that redirects are simply unsupported for worker loading under CSPs, but if so are we loading workers from that origin at all? If not, we should remove it.

Outcome

What did you expect?

What happened instead?

Operating system

No response

Browser information

No response

URL for webapp

No response

Application version

No response

Homeserver

No response

Will you send logs?

No

[t3chguy]

It may be that redirects are simply unsupported for worker loading under CSPs, but if so are we loading workers from that origin at all? If not, we should remove it.

The fallback redirect applies to the entire bundle directory

[richvdh]

It may be that redirects are simply unsupported for worker loading under CSPs, but if so are we loading workers from that origin at all? If not, we should remove it.

The fallback redirect applies to the entire bundle directory

@t3chguy I'm slightly unclear what this means, in practice. Are you saying that the worker-src does match where workers are loaded from (in which case, this issue is incorrect and should probably be closed)?