diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 4d6f7852a7..e4b49f0d13 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -8980,6 +8980,25 @@ nsContentUtils::StreamsEnabled(JSContext* aCx, JSObject* aObj)
   return workerPrivate->StreamsEnabled();
 }
 
+// static
+bool
+nsContentUtils::CSPEnabled(JSContext* aCx, JSObject* aObj)
+{
+  if (NS_IsMainThread()) {
+    return Preferences::GetBool("security.csp.enabled", true);
+  }
+
+  using namespace workers;
+
+  // Otherwise, check the pref via the WorkerPrivate
+  WorkerPrivate* workerPrivate = GetWorkerPrivateFromContext(aCx);
+  if (!workerPrivate) {
+    return false;
+  }
+
+  return workerPrivate->CSPEnabled();
+}
+
 // static
 bool
 nsContentUtils::IsNonSubresourceRequest(nsIChannel* aChannel)
diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h
index dd0968c9c0..00871628cf 100644
--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -2798,6 +2798,8 @@ public:
 
   static bool PushEnabled(JSContext* aCx, JSObject* aObj);
   
+  static bool CSPEnabled(JSContext* aCx, JSObject* aObj);
+  
   static bool StreamsEnabled(JSContext* aCx, JSObject* aObj);
 
   static bool IsNonSubresourceRequest(nsIChannel* aChannel);
diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index 62a582e734..7d36e47da9 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -578,7 +578,7 @@ ContentSecurityPolicyAllows(JSContext* aCx, JS::HandleValue aValue)
   WorkerPrivate* worker = GetWorkerPrivateFromContext(aCx);
   worker->AssertIsOnWorkerThread();
 
-  if (worker->GetReportCSPViolations()) {
+  if (worker->CSPEnabled() && worker->GetReportCSPViolations()) {
     JS::Rooted<JSString*> jsString(aCx, JS::ToString(aCx, aValue));
     if (NS_WARN_IF(!jsString)) {
       JS_ClearPendingException(aCx);
@@ -2715,12 +2715,14 @@ LogViolationDetailsRunnable::MainThreadRun()
 {
   AssertIsOnMainThread();
 
-  nsIContentSecurityPolicy* csp = mWorkerPrivate->GetCSP();
-  if (csp) {
-    if (mWorkerPrivate->GetReportCSPViolations()) {
-      csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
-                               mFileName, mScriptSample, mLineNum, mColumnNum,
-                               EmptyString(), EmptyString());
+  if (mWorkerPrivate->CSPEnabled()) {
+    nsIContentSecurityPolicy* csp = mWorkerPrivate->GetCSP();
+    if (csp) {
+      if (mWorkerPrivate->GetReportCSPViolations()) {
+        csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
+                                 mFileName, mScriptSample, mLineNum, mColumnNum,
+                                 EmptyString(), EmptyString());
+      }
     }
   }
 
diff --git a/dom/workers/ScriptLoader.cpp b/dom/workers/ScriptLoader.cpp
index f6a4943653..5dc4038be5 100644
--- a/dom/workers/ScriptLoader.cpp
+++ b/dom/workers/ScriptLoader.cpp
@@ -1102,17 +1102,19 @@ private:
         return NS_ERROR_NOT_AVAILABLE;
       }
 
-      httpChannel->GetResponseHeader(
-        NS_LITERAL_CSTRING("content-security-policy"),
-        tCspHeaderValue);
+      if (mWorkerPrivate->CSPEnabled()) {
+        httpChannel->GetResponseHeader(
+          NS_LITERAL_CSTRING("content-security-policy"),
+          tCspHeaderValue);
 
-      httpChannel->GetResponseHeader(
-        NS_LITERAL_CSTRING("content-security-policy-report-only"),
-        tCspROHeaderValue);
+        httpChannel->GetResponseHeader(
+          NS_LITERAL_CSTRING("content-security-policy-report-only"),
+          tCspROHeaderValue);
 
-      httpChannel->GetResponseHeader(
-        NS_LITERAL_CSTRING("referrer-policy"),
-        tRPHeaderCValue);
+        httpChannel->GetResponseHeader(
+          NS_LITERAL_CSTRING("referrer-policy"),
+          tRPHeaderCValue);
+      }
     }
 
     // May be null.
@@ -1164,13 +1166,15 @@ private:
       //  by using the SRICheck module
       MOZ_LOG(SRILogHelper::GetSriLog(), mozilla::LogLevel::Debug,
             ("Scriptloader::Load, SRI required but not supported in workers"));
-      nsCOMPtr<nsIContentSecurityPolicy> wcsp;
-      chanLoadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(wcsp));
-      MOZ_ASSERT(wcsp, "We should have a CSP for the worker here");
-      if (wcsp) {
-        wcsp->LogViolationDetails(
-            nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
-            aLoadInfo.mURL, EmptyString(), 0, 0, EmptyString(), EmptyString());
+      if (mWorkerPrivate->CSPEnabled()) {      
+        nsCOMPtr<nsIContentSecurityPolicy> wcsp;
+        chanLoadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(wcsp));
+        MOZ_ASSERT(wcsp, "We should have a CSP for the worker here");
+        if (wcsp) {
+          wcsp->LogViolationDetails(
+              nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
+              aLoadInfo.mURL, EmptyString(), 0, 0, EmptyString(), EmptyString());
+        }
       }
       return NS_ERROR_SRI_CORRUPT;
     }
@@ -1242,7 +1246,9 @@ private:
 
       // We did inherit CSP in bug 1223647. If we do not already have a CSP, we
       // should get it from the HTTP headers on the worker script.
-      if (!mWorkerPrivate->GetCSP() && CSPService::sCSPEnabled) {
+      if (mWorkerPrivate->CSPEnabled() &&
+          !mWorkerPrivate->GetCSP() &&
+          CSPService::sCSPEnabled) {
         rv = mWorkerPrivate->SetCSPFromHeaderValues(tCspHeaderValue,
                                                     tCspROHeaderValue);
         NS_ENSURE_SUCCESS(rv, rv);
@@ -1320,9 +1326,11 @@ private:
       MOZ_ALWAYS_SUCCEEDS(responsePrincipal->Equals(principal, &equal));
       MOZ_DIAGNOSTIC_ASSERT(equal);
 
-      nsCOMPtr<nsIContentSecurityPolicy> csp;
-      MOZ_ALWAYS_SUCCEEDS(responsePrincipal->GetCsp(getter_AddRefs(csp)));
-      MOZ_DIAGNOSTIC_ASSERT(!csp);
+      if (mWorkerPrivate->CSPEnabled()) {
+        nsCOMPtr<nsIContentSecurityPolicy> csp;
+        MOZ_ALWAYS_SUCCEEDS(responsePrincipal->GetCsp(getter_AddRefs(csp)));
+        MOZ_DIAGNOSTIC_ASSERT(!csp);
+      }
 #endif
 
       mWorkerPrivate->InitChannelInfo(aChannelInfo);
@@ -1335,9 +1343,11 @@ private:
       rv = mWorkerPrivate->SetPrincipalOnMainThread(responsePrincipal, loadGroup);
       MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
 
-      rv = mWorkerPrivate->SetCSPFromHeaderValues(aCSPHeaderValue,
-                                                  aCSPReportOnlyHeaderValue);
-      MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
+      if (mWorkerPrivate->CSPEnabled()) {
+        rv = mWorkerPrivate->SetCSPFromHeaderValues(aCSPHeaderValue,
+                                                    aCSPReportOnlyHeaderValue);
+        MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
+      }
     }
 
     if (NS_SUCCEEDED(rv)) {
@@ -1357,9 +1367,13 @@ private:
         // XHR Params Allowed
         mWorkerPrivate->SetXHRParamsAllowed(parent->XHRParamsAllowed());
 
-        // Set Eval and ContentSecurityPolicy
-        mWorkerPrivate->SetCSP(parent->GetCSP());
-        mWorkerPrivate->SetEvalAllowed(parent->IsEvalAllowed());
+        if (mWorkerPrivate->CSPEnabled()) {
+          // Set Eval and ContentSecurityPolicy
+          mWorkerPrivate->SetCSP(parent->GetCSP());
+          mWorkerPrivate->SetEvalAllowed(parent->IsEvalAllowed());
+        } else {
+          mWorkerPrivate->SetEvalAllowed(true);
+        }
       }
     }
   }
@@ -1754,10 +1768,12 @@ CacheScriptLoader::ResolvedCallback(JSContext* aCx,
   InternalHeaders* headers = response->GetInternalHeaders();
 
   IgnoredErrorResult ignored;
-  headers->Get(NS_LITERAL_CSTRING("content-security-policy"),
-               mCSPHeaderValue, ignored);
-  headers->Get(NS_LITERAL_CSTRING("content-security-policy-report-only"),
-               mCSPReportOnlyHeaderValue, ignored);
+  if (nsContentUtils::CSPEnabled(aCx, obj)) {
+    headers->Get(NS_LITERAL_CSTRING("content-security-policy"),
+                 mCSPHeaderValue, ignored);
+    headers->Get(NS_LITERAL_CSTRING("content-security-policy-report-only"),
+                 mCSPReportOnlyHeaderValue, ignored);
+  }
 
   nsCOMPtr<nsIInputStream> inputStream;
   response->GetBody(getter_AddRefs(inputStream));
diff --git a/dom/workers/WorkerPrefs.h b/dom/workers/WorkerPrefs.h
index 2fb0d36cfd..87806a6fbc 100644
--- a/dom/workers/WorkerPrefs.h
+++ b/dom/workers/WorkerPrefs.h
@@ -40,6 +40,7 @@ WORKER_SIMPLE_PREF("gfx.offscreencanvas.enabled", OffscreenCanvasEnabled, OFFSCR
 WORKER_SIMPLE_PREF("dom.webkitBlink.dirPicker.enabled", WebkitBlinkDirectoryPickerEnabled, DOM_WEBKITBLINK_DIRPICKER_WEBKITBLINK)
 WORKER_SIMPLE_PREF("dom.abortController.enabled", AbortControllerEnabled, ABORTCONTROLLER_ENABLED)
 WORKER_SIMPLE_PREF("dom.fetchObserver.enabled", FetchObserverEnabled, FETCHOBSERVER_ENABLED)
+WORKER_SIMPLE_PREF("security.csp.enable", CSPEnabled, CSP_ENABLED)
 WORKER_PREF("dom.workers.latestJSVersion", JSVersionChanged)
 WORKER_PREF("intl.accept_languages", PrefLanguagesChanged)
 WORKER_PREF("general.appname.override", AppNameOverrideChanged)