Content Security Policy violation on external Js Script

Question

sorry for bad description. I have an app that works fine on localhost and test server. On the machine that has connection to test server when I try to access the app via server's IP and port I can access the app too. But with a rerouting that points to my apps test server IP and port I get below 2 errors in a script that I use from a different host. Test server doesn't has outside connection allowed but related script host has been allowed. I have tried adding CSP headers to ISS but it didn't work. How can I resolve this issue or how can I get more details about it. Any help would appreciated. Thank you.

1st error:

Refused to create a worker from 'blob: https://redirecteddomain.com/04891805-36bb-45f7-a4e9-7cb58f25a3bf' because it violates the following Content Security Policy directive: "default-src https: data: 'unsafe-inline' 'unsafe-eval'". Note that 'worker-src' was not explicitly set, so 'default-src' is used as a fallback.

2nd error:

Uncaught DOMException: Failed to construct 'Worker': Access to the script at 'blob: https://redirecteddomain.com/04891805-36bb-45f7-a4e9-7cb58f25a3bf' is denied by the document's Content Security Policy.

Script that got the error:

<script src="https://scriptsource.com/script.php?lang=en"></script>

Due to privacy issues domain names are replaced.

Update: So I have tried to download and use the script locally and there were couple of API calls in the javascript file and it gave the same error again.

Update-2: I have checked through the script file and found the lines that are causing the issue, I have added "default-src 'self' 'unsafe-inline'; worker-src blob:;" meta header but still get the same error

const e=window.URL||window.webkitURL,n=new 
Blob(['importScripts("'+Dt.faceworker+"?v="+t.replace(/\./g,"")+'");'], 
{type:"application/javascript"}),o=e.createObjectURL(n);
Wt=new Worker(o)

Answer 1

The CSP on your page doesn't allow "blob:". Adding another CSP in a meta tag can only impose restrictions, it can't change the other CSP that is likely there and served in a response header. You will likely need to modify the original CSP adding blob: to default-src or worker-src.