Web workers [disregard the CSP set by the parent context](https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Using_web_workers). This means you must set a CSP for the web worker via a header.
Web workers disregard the CSP set by the parent context. This means you must set a CSP for the web worker via a header.