Content Security Policy with Chrome Extensions - Getting data via remote URL

Question

I've made a chrome extension with the following line in the manifest.json, so that I can get data via an ajax request.

"content_security_policy": "script-src 'self' http://localhost; object-src 'self'",

I want to test the extension with my live site, so I changed it to:

"content_security_policy": "script-src 'self' http://www.example.com; object-src 'self'",

but now the extension doesn't initialize when I start chrome.

where would the error messaged be logged if the extension fails to load? — xylar, Feb 23 '13 at 19:18
for content-script : press F12(open developer tool) and reload the page in console section of developer tool you would see the error — Raghvendra Parashar, Feb 24 '13 at 05:22
unfortunately the console didn't display any errors relating to the extension not displaying. — xylar, Feb 25 '13 at 21:45

score 1 · Accepted Answer · answered Feb 24 '13 at 06:38

To make cross-origin XHRs, you don't need to care about CSP. What you need to add in the manifest is host permissions for those hosts you need to access. Read https://developer.chrome.com/trunk/extensions/xhr.html for more information.

On the other hand, if your extension loads scripts (<script src="..."></script>) from an external web server, you must be aware of CSP. First, the server hosting the scripts must be HTTPS. Then, whilelist it in CSP as described in https://developer.chrome.com/trunk/extensions/contentSecurityPolicy.html#relaxing-remote-script.

Whitelisting a HTTP origin in 'script-src' is prohibited to prevent man-in-the-middle attacks and other security isuses so that your extension doesn't load.

Thanks. I had to amend it to `"content_security_policy": "script-src 'self' https://www.example.com; object-src 'self'"`. I just need to find a way to get my site working via https now. — xylar, Feb 25 '13 at 21:44

Raghvendra Parashar · Answer 2 · 2013-02-24T05:27:00.550

0

Have you added permissions, if not then try this, hope it would work

,
 "permissions": [
   "http://www.example.com/*", 
   "tabs"
 ],
"content_scripts": [
  {
    "matches": [
        "http://www.example.com/*"
    ],
    "js": [
        "js/myScript.js"
    ]
  }
]

edited Feb 24 '13 at 05:27

answered Feb 23 '13 at 18:33

Raghvendra Parashar

3,883
1
23
36

added the line but it still doesn't load. – xylar Feb 23 '13 at 18:50

Content Security Policy with Chrome Extensions - Getting data via remote URL

2 Answers2