v147 · Developer Trial · Workers · Security
Compatibility Lab
Probes Dedicated Worker availability, tests eval and sync XHR access inside a blob-URL worker, and detects Document Policy header presence. Spawns a real worker to compare permissive vs. restricted behaviour, and provides the HTTP header pattern for enforcing policy in workers.
API probes
Document Policy directive support matrix
| Directive | Main thread | Dedicated Worker (Chrome 147+) | Effect |
|---|---|---|---|
| js-profiling | ✓ | ✓ Chrome 147+ | Enables Profiler API |
| sync-xhr=?0 | ✓ | ✓ Chrome 147+ | Blocks synchronous XHR |
| unsized-media=?0 | ✓ | N/A (no DOM) | Blocks images without explicit dimensions |
| no-document-write | ✓ | N/A (no DOM) | Blocks document.write() |
| oversized-images=(1.0) | ✓ | N/A (no DOM) | Limits image oversizing factor |
Live worker capability probe
Worker: eval + sync XHR + Profiler availability
Click "Spawn worker and probe" to test capabilities inside a Dedicated Worker…
Document Policy header pattern
/* Document Policy in Dedicated Workers (server-side header) */
/* The Document-Policy header is set by the server on the main document.
Workers spawned from that document inherit the policy in Chrome 147+. */
/* Server response headers: */
// Document-Policy: js-profiling, sync-xhr=?0
/* js-profiling — enables the JS Self-Profiling API in workers:
const profiler = new Profiler({ sampleInterval: 10, maxBufferSize: 10000 });
sync-xhr=?0 — disables synchronous XMLHttpRequest in workers:
const xhr = new XMLHttpRequest();
xhr.open('GET', url, false); // false = synchronous
xhr.send(); // → throws PolicyException */
/* Detect if policy is enforced via violation events */
document.addEventListener('securitypolicyviolation', (e) => {
if (e.effectiveDirective === 'document-policy') {
console.warn('Document policy violation:', e.violatedDirective);
}
});
/* Worker code (inherits parent's Document Policy in Chrome 147+) */
const workerCode = `
// Test sync XHR (blocked if sync-xhr=?0)
try {
const xhr = new XMLHttpRequest();
xhr.open('GET', location.origin + '/', false);
xhr.send();
self.postMessage({ syncXhr: 'allowed' });
} catch (e) {
self.postMessage({ syncXhr: 'blocked: ' + e.message });
}
// Test Profiler (requires js-profiling directive)
self.postMessage({ hasProfiler: typeof Profiler !== 'undefined' });
`;
const blob = new Blob([workerCode], { type: 'application/javascript' });
const worker = new Worker(URL.createObjectURL(blob));
worker.onmessage = (e) => console.log('Worker result:', e.data);
references
implementation reference
Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗