v147 · Developer Trial · Workers · Security

Compatibility Lab

Probes Dedicated Worker availability, tests eval and sync XHR access inside a blob-URL worker, and detects Document Policy header presence. Spawns a real worker to compare permissive vs. restricted behaviour, and provides the HTTP header pattern for enforcing policy in workers.

Developer Trial: Document Policy in Dedicated Workers requires the Document-Policy HTTP response header. Without it, workers run in permissive mode and all operations are allowed.

API probes

Document Policy directive support matrix

DirectiveMain threadDedicated Worker (Chrome 147+)Effect
js-profiling✓ Chrome 147+Enables Profiler API
sync-xhr=?0✓ Chrome 147+Blocks synchronous XHR
unsized-media=?0N/A (no DOM)Blocks images without explicit dimensions
no-document-writeN/A (no DOM)Blocks document.write()
oversized-images=(1.0)N/A (no DOM)Limits image oversizing factor

Live worker capability probe

Worker: eval + sync XHR + Profiler availability
Click "Spawn worker and probe" to test capabilities inside a Dedicated Worker…

Document Policy header pattern

/* Document Policy in Dedicated Workers (server-side header) */ /* The Document-Policy header is set by the server on the main document. Workers spawned from that document inherit the policy in Chrome 147+. */ /* Server response headers: */ // Document-Policy: js-profiling, sync-xhr=?0 /* js-profiling — enables the JS Self-Profiling API in workers: const profiler = new Profiler({ sampleInterval: 10, maxBufferSize: 10000 }); sync-xhr=?0 — disables synchronous XMLHttpRequest in workers: const xhr = new XMLHttpRequest(); xhr.open('GET', url, false); // false = synchronous xhr.send(); // → throws PolicyException */ /* Detect if policy is enforced via violation events */ document.addEventListener('securitypolicyviolation', (e) => { if (e.effectiveDirective === 'document-policy') { console.warn('Document policy violation:', e.violatedDirective); } }); /* Worker code (inherits parent's Document Policy in Chrome 147+) */ const workerCode = ` // Test sync XHR (blocked if sync-xhr=?0) try { const xhr = new XMLHttpRequest(); xhr.open('GET', location.origin + '/', false); xhr.send(); self.postMessage({ syncXhr: 'allowed' }); } catch (e) { self.postMessage({ syncXhr: 'blocked: ' + e.message }); } // Test Profiler (requires js-profiling directive) self.postMessage({ hasProfiler: typeof Profiler !== 'undefined' }); `; const blob = new Blob([workerCode], { type: 'application/javascript' }); const worker = new Worker(URL.createObjectURL(blob)); worker.onmessage = (e) => console.log('Worker result:', e.data);

references

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗