Content-Security-Policy · Docs

Entries to add #

HTTP

Content-Security-Policy:
  script-src 'self' https://blockalt.click;
  connect-src 'self' https://blockalt.click;
  worker-src 'self' blob:;

Directive	Why
`script-src https://blockalt.click`	Loads the script from `/v1/assets/`. Keep the integrity attribute: CSP decides where scripts may come from, SRI pins the exact file
`connect-src https://blockalt.click`	The script fetches the signed configuration, the challenge and the token from the API
`worker-src blob:`	Optional. Lets the faster solver run in background workers created from the script itself

Without blob: workers #

If your policy does not allow blob: workers (worker-src, or child-src, script-src and default-src in that order when it is absent), or Trusted Types forbid creating the worker, the script solves the challenge on the main thread in small slices instead. It still works, only more slowly, and the page stays responsive. You do not need to detect this yourself.

Nonces and strict-dynamic #

With a nonce-based policy and 'strict-dynamic', give the BlockAlt script tag your nonce as well as its integrity attribute. Host allow-lists are ignored under 'strict-dynamic', so the nonce is what allows the file.

Read guard #

The read helper talks only to your own origin (/__blockalt/session by default), which connect-src 'self' already allows. Server-sent event streams need nothing else.

Checking #

Open your page with the browser's developer tools and submit a protected form once: a CSP violation names the blocked directive. The console's decision log shows nothing for a blocked script, because no request reached BlockAlt.