Web workers [disregard the CSP set by the parent context](https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Using_web_workers). This means you must set a CSP for the web worker via a header.