2026-06-01 21:25:57 +02:00
1 changed files with 4 additions and 0 deletions
--- a/infra/caddy/Caddyfile
+++ b/infra/caddy/Caddyfile
@@ -22,6 +22,10 @@
 		# XSS landing in a privileged origin: a payload cannot silently turn
 		# on the microphone or read geolocation.
 		Permissions-Policy "camera=(), microphone=(), geolocation=()"
+		# No Content-Security-Policy is set yet. When one is added, it MUST
+		# include `script-src 'wasm-unsafe-eval'` and `worker-src 'self' blob:`
+		# or the pdf.js WebAssembly image decoders (JBIG2/CCITTFax/JPEG2000)
+		# and worker will be blocked and scanned PDFs render blank. See #708.
 		-Server
 	}
 }