Question

I’m developing a Chrome plugin where external scripts are loaded from several domains. I’ve checked out the documentation and some tutorials about how to allow those domains.

The docs I’ve checked:

• http://developer.chrome.com/extensions/contentSecurityPolicy.html
• http://www.html5rocks.com/en/tutorials/security/content-security-policy/
• http://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#syntax

It all says the same, from which I created this rule in the manifest.json:

{
  // .. general settings
  "content_security_policy": "script-src 'self' https://ajax.googleapis.com http://mysite.com; object-src 'self'"
}

To this Chrome responds the following:

Could not load extension from '/Users/itarato/Desktop/DRC Tutorial Client'. 
Invalid value for 'content_security_policy': Both 'script-src' and 'object-src' directives must be specified (either explicitly, or implicitly via 'default-src'), and both must whitelist only secure resources. 
You may include any of the following sources: "'self'", "'unsafe-eval'", "http://127.0.0.1", "http://localhost", or any "https://" or "chrome-extension://" origin. 
For more information, see http://developer.chrome.com/extensions/contentSecurityPolicy.html

Of course I’ve tried several combinations but all failed. It only works if I use one domain only. How can I add more?

Answer 1

The syntax you have is fine, the problem is that your http://mysite.com source is not secure. The “whitelist only secure resources” part of the Chrome error message refers to this. You’ll need to use https://mysite.com.