I am using an external JavaScript lib in my chrome extension. I has inline execution, so I get following kind of error
(The error I get on console)
Copied from my answer to a similar question here. For recent versions of Chrome (46+) the current answer is no longer true. unsafe-inline still has no effect (in both the manifest and in meta header tags), but per the documentation, you can use the technique described here to relax the restriction.
Hash usage for
elementsThe
script-srcdirective lets developers whitelist a particular inline script by specifying its hash as an allowed source of script.Usage is straightforward. The server computes the hash of a particular script block’s contents, and includes the base64 encoding of that value in the
Content-Security-Policyheader:Content-Security-Policy: default-src 'self'; script-src 'self' https://example.com 'sha256-base64 encoded hash'
As an example, consider:
manifest.json:
{
"manifest_version": 2,
"name": "csp test",
"version": "1.0.0",
"minimum_chrome_version": "46",
"content_security_policy": "script-src 'self' 'sha256-WOdSzz11/3cpqOdrm89LBL2UPwEU9EhbDtMy2OciEhs='",
"background": {
"page": "background.html"
}
}
background.html:
Result:
I also tested putting the applicable directive in a meta tag instead of the manifest. While the CSP indicated in the console message did include the content of the tag, it would not execute the inline script (in Chrome 53).
new background.html:
Result: