addModule() + CSP: requires "blob:" in script-src or default-src

[VictorQueiroz]

Hi, thank you for this amazing library. It's been really nice to work with it. Recently after migrating the entire app to use the standardized-audio-context library, I'm facing a production-only problem (now I know it's due to CSP rules) while trying to add audio worklet.

If blob: is not added to script-src or default-src directives, we receive the following error with no extra warning when addModule is called:

DOMException: The user aborted a request.

I had to read the source code to find out it was changing the original source code of the worklet source file and using blob: protocol instead, without any warnings (at least I didn't find any).

It'd be helpful to see some warnings for those using strict CSP rules and maybe add the option to not change the source code of the original worklet file.

[chrisguttandin]

Hi Victor, thanks for filing this issue.

I think it would be cool to use standardized-audio-context without allowing blob: as a script-src.

Currently the worklet code gets patched to fix a few browser bugs. I wonder if it would be possible to provide that same functionality as a separate library. Instead of the patching the code at runtime one could use that library to write the worket itself.

import { AudioWorkletProcessor, registerProcessor } from 'standardized-audio-worklet-processor';

class MyProcessor extends AudioWorkletProcessor {

}

registerProcessor('my-processor', MyProcessor);

Would that work for you? Do you have a build step to transpile/compile/bundle the worklet code?