demo · v147 · workers · security

Policy Inheritance Tester

Spawn a real Blob-URL Dedicated Worker and probe Document Policy directives from both the main thread and worker thread. The policy tree shows which restrictions apply at each level.

Document Policy directives flow from the document into its workers. Click Probe from main thread or Probe from worker to test each restriction. The event log captures results from both execution contexts. Toggle Strict mode to simulate Document-Policy: * and observe the full block list.
document (main thread)
window — this page
dedicated worker (blob URL)
Worker — spawned from main thread

oversized-images

Blocks images whose intrinsic size exceeds a ratio threshold. Workers: blocks off-screen image decode.

—

sync-xhr

Blocks synchronous XMLHttpRequest. Affects both main thread and workers (Chrome 147 extends this to workers).

—

document-write

Blocks document.write(). Not applicable inside workers (workers have no document), but the policy still propagates.

—

js-profiling

Enables the JS Profiler API. Off by default; must be opted in. Workers inherit the opt-in from the document.

—

how Document Policy propagates to workers

// Server sets the policy on the document:
// Document-Policy: no-document-write, sync-xhr=()

// When the page spawns a worker, the worker inherits the policy
const worker = new Worker('worker.js');
// worker.js now runs under the same Document-Policy as the document

// Inside worker.js — sync-xhr is blocked per inherited policy:
try {
  const xhr = new XMLHttpRequest();
  xhr.open('GET', '/data', false); // synchronous flag
  xhr.send(); // throws if sync-xhr policy is enforced
} catch(e) {
  self.postMessage({ violation: 'sync-xhr', error: e.message });
}

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗