Chrome Plugin and Content Security Policy errors

Question

When uploading my unpacked Chrome extension, I get the following error:

Could not load extension from '/Users/me/example'. Invalid value for 'content_security_policy': Both 'script-src' and 'object-src' directives must be specified (either explicitly, or implicitly via 'default-src'), and both must whitelist only secure resources. You may include any of the following sources: "'self'", "'unsafe-eval'", "http://127.0.0.1", "http://localhost", or any "https://" or "chrome-extension://" origin. For more information, see http://developer.chrome.com/extensions/contentSecurityPolicy.html

My manifest looks like the following:

{
  "name": "Example Inc.",
  "manifest_version" : 2,
  "version": "0.4.4",
  "content_scripts": [
    {
      "matches": [
        "*://*.example.cc/*"
      ],
      "js": [
        "production/jquery.libs.min.js",
        "https://example.cc/js/example.js"
      ],
      "run_at": "document_end"
    }
  ],
  "permissions": [
    "*://*.example.cc/*",
    "tabs",
    "activeTab",
    "contextMenus",
    "storage",
    "management",
    "cookies"
  ],
  "content_security_policy": "script-src 'self' https://ssl.google-analytics.com/ga.js https://example.cc/js/*; object-src 'self'"
}

From all the examples I've seen, and after reading through some of the CSP docs, I'm not sure what I'm missing. Our domain is fully https, the example.js file exists and is accessible, etc

Any ideas are welcome!

score 1 · Answer 1 · answered Feb 17 '21 at 02:03

1

if you are only using your code set it to self only e.g.

"content_security_policy": "script-src 'self'; default-src 'self'",

answered Feb 17 '21 at 02:03

pref

1,651
14
24

score 0 · Answer 2 · answered Jun 09 '14 at 20:20

0

You should do:

"content_security_policy": "script-src 'self' https://ssl.google-analytics.com/ga.js https://example.cc; object-src 'self'"

answered Jun 09 '14 at 20:20

Aminadav Glickshtein

23,232
12
77
117

6

To make this a better answer, explain what the problem was. – Xan Jun 09 '14 at 21:09
Using this entry, I get the following error when trying the upload: Could not load extension from '/Users/me/example'. Could not load javascript '' for content script. – dylst Jun 10 '14 at 15:48
@Xan scroll up and read the original question – user3286381 Apr 19 '21 at 17:37

Chrome Plugin and Content Security Policy errors

2 Answers2