I've tried all possible setups for the CSP settings in my manifest.json, this is my current (very open and unsafe, I know).

When I open the background inspect for the extension, the first time after reloading it's fine, sometimes up until the fifth time, and then all of a sudden the errors below start pouring in..

"content_security_policy": "default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';"

And still I'm getting the following error

Refused to load the script '/.lp?start=t&ser=1234567&cb=15&v=5' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

What I've tried

• Removing the chrome extension when I change the manifest.json

Is there anything I'm missing?

I've tried all possible setups for the CSP settings in my manifest.json, this is my current (very open and unsafe, I know).

When I open the background inspect for the extension, the first time after reloading it's fine, sometimes up until the fifth time, and then all of a sudden the errors below start pouring in..

"content_security_policy": "default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';"

And still I'm getting the following error

Refused to load the script 'https://myapp-12345.firebaseio./.lp?start=t&ser=1234567&cb=15&v=5' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

What I've tried

• Removing the chrome extension when I change the manifest.json

Is there anything I'm missing?

• javascript
• google-chrome-extension
• content-security-policy

• 1) The error message says there's no * in script-src 2) Why don't you specify the domain myapp-12345.firebaseio. instead of *? – woxxom Commented Jul 19, 2019 at 13:00
• Because that's also not working, So I'm trying to loosen up the rules to see what's going on. – Miguel Stevens Commented Jul 19, 2019 at 13:01
• Since it should work and usually works, apparently you've encountered a bug in Chrome. See if it's reported on crbug. or report it yourself otherwise. – woxxom Commented Jul 19, 2019 at 13:03

1 Answer 1

You can only relax CSP in Chrome extensions to a certain extent

"content_security_policy" entry in Chrome Extension manifest allows developers to relax the CSP to a certain extent only. The subset of values allowed for style-src is very limited, quote from the official documentation:

Currently, developers can allowlist origins with the following schemes: blob, filesystem, https, and chrome-extension. The host part of the origin must explicitly be specified for the https and chrome-extension schemes. Generic wildcards such as https:, https://* and https://*. are not allowed; ...

Many of the values specified in your CSP (eg. * and 'unsafe-inline' for script-src) are not valid in "content_security_policy" and Chrome ignores them (with a warning) when parsing manifest.json.

Why you don't see warnings or errors about the invalid CSP values

I suspect that you might be checking errors in JavaScript console of the background page. You need to check the errors and warnings generated for your manifest.json first. Go to chrome://extensions/ and click on the Errors button for your extension. There will be several warnings such as this:

content_security_policy': Ignored insecure CSP value "*" in directive 'script-src'.

Edit: I just noticed that the Errors page (chrome://extensions/?errors=<extension-id>) behaves inconsistently. There seems to be a bug that causes the warnings about ignored CSP values to only show up after reloading the extension.

Links to documentation:

"content_security_policy" in Chrome

"content_security_policy" in Firefox
(The specification is basically identical but I find the documentation on MDN nicer and easier to follow.)