2014-04-21 153 views
0

这是来自我的Chrome扩展。Chrome扩展中的内容安全策略问题

"permissions": [ 
"storage", 
"https://app.socialschools.nl/*", 
"http://*.google.com/", // Refer to http://goo.gl/CPeqK http://goo.gl/U3Vev 
"bookmarks", // http://code.google.com/chrome/extensions/bookmarks.html 
"chrome://favicon/", 
"clipboardRead", // document.execCommand('paste'). 
"clipboardWrite", // document.execCommand('copy' OR 'cut') 
"contextMenus", //http:///code.google.com/chrome/extensions/contextMenus.html 
"cookies", // http://code.google.com/chrome/extensions/cookies.html 
// "experimental", // http://code.google.com/chrome/extensions/dev/experimental.html 
"fileBrowserHandler", // http://goo.gl/GqbrP 
"geolocation", // http://dev.w3.org/geo/api/spec-source.html 
"history", // http://code.google.com/chrome/extensions/history.html 
"idle", // http://code.google.com/chrome/extensions/idle.html 
"management", // http://code.google.com/chrome/extensions/management.html 
"notifications", // code.google.com/chrome/extensions/notifications.html 
"tabs", // http://code.google.com/chrome/extensions/tabs.html +windows.html 
"tts", // http://code.google.com/chrome/extensions/tts.html 
"ttsEngine", // http://code.google.com/chrome/extensions/ttsEngine.html 
"unlimitedStorage" 
], 

"content_security_policy":"script-src 'unsafe-eval' https://apps.socialschools.nl/;object-src 'self';connect-src https://app.socialschools.nl/", 

我加入了两个剧本-SRC,权限的API URL(https://app.socialschools.nl)和连接-SRC。仍然,我得到这个错误:

Refused to load the script 'https://app.socialschools.nl/apiv1/public/924/post/?callback=jQuery16200253…109_1398087409246&only_descendants=false&number_of_items=5&_=1398087409299' because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' https://apps.socialschools.nl/". 

我似乎无法理解我在这里失踪?有人可以帮我解决这个问题。

在此先感谢。

+0

你把'apps'而不是'app'。 – rsanchez

回答

1

我发现API尚不支持HTTPS,而CSP的脚本src需要HTTPS用于外部源。因此,内容安全策略存在问题。

+0

该网站托管在Heroku上,因此您可以尝试使用https:// socialschools-production.herokuapp.com/apiv1/public/924/post /'代替。 – abraham

+0

感谢您的建议!但由于它受限于一个域(app.socialschools.nl),它给了我一个内部服务器错误。 –