Content Security Policy blocks K3
Symptoms
After embedding the K3 configurator, error messages such as appear in the browser console:
Creating a worker from 'blob:https://www.example.com/...' violates the
following Content Security Policy directive: "script-src 'self' ...".
Note that 'worker-src' was not explicitly set, so 'script-src' is used
as a fallback. The action has been blocked.
The configurator does not load completely or displays errors.
Cause
Many websites use Content Security Policy (CSP) as a security measure. CSP defines which resources (scripts, styles, images, etc.) may be loaded from which sources.
K3 uses Web Workers for background operations (e.g. 3D rendering, calculations) in order not to block the user interface. These workers are created as so-called blob URLs - a common technique in modern web applications.
If the website's CSP does not explicitly allow blob:, the browser blocks the creation of these workers.
Solution
The content security policy must be extended by blob:.
Recommended variant (specific for Worker)
If your CSP can define worker-src separately:
worker-src 'self' blob:;
This variant is more secure as it only allows blob: for web workers.
Alternative variant (in script-src)
If worker-src cannot be defined separately, blob: must be added to script-src:
script-src 'self' https://k3.objectcode.de blob:;
The content security policy is typically configured in one of these places:
- HTTP header on the web server (Apache, Nginx, etc.)
- Meta tag in the HTML header of the website
- Shop system or CMS settings (e.g. Shopware, WordPress plugins)
- Hosting provider security settings
Contact your webmaster or hosting provider if you are unsure.
Security notice
**Is blob: a security risk?
Adding blob: allows the browser to create executable code from binary data objects stored in memory.
If your CSP already contains the following directives, blob: does not increase the risk significantly:
| directive | meaning | risk |
|---|---|---|
'unsafe-inline' | Allows inline scripts in HTML | Higher |
'unsafe-eval' | Allows eval() and string-to-code conversion | Higher |
blob: | Allows blob URLs for workers | Lower |
Most modern web applications with 3D rendering or complex calculations require web workers and therefore blob: support.
Full CSP example
A minimal CSP for K3 could look like this:
default-src 'self';
script-src 'self' https://k3.objectcode.de 'unsafe-inline' 'unsafe-eval';
worker-src 'self' blob:;
style-src 'self' 'unsafe-inline';
img-src 'self' https://k3.objectcode.de data: blob:;
connect-src 'self' https://k3.objectcode.de https://api.objectcode.de;
font-src 'self' https://k3.objectcode.de;
You can see CSP problems in the browser developer tools (F12) under "Console" or "Network". Blocked resources are displayed there with corresponding error messages.