Sandboxes not applying CSP!

I'm having lots of problems with applying my custom csp to my sandboxed page. I have in my manifest overrides
"content_security_policy": {
"sandbox": "sandbox allow-scripts; script-src 'self' https://apis.google.com"
},
"content_security_policy": {
"sandbox": "sandbox allow-scripts; script-src 'self' https://apis.google.com"
},
However my CSP is always:
script-src 'self' http://localhost;object-src 'self';
script-src 'self' http://localhost;object-src 'self';
When requested, am I doing something wrong or is this just glitching? I can't seem to find much documentation on this 😦
9 Replies
Arcane
Arcane•17mo ago
@acorn221 has reached level 5. GG!
acorn221
acorn221OP•17mo ago
@louisgv if you get a chance to look at this, it would be much appreciated ♥ (lmk if you want me to provide an example repo) For the life of me, I can't get this to work for some reason I'd also be more than happy to submit a pr to the example repo with the solution
lab
lab•17mo ago
@acorn221 yeah can you make it into a repo, also checkout the with-wasm-zig repo for the csp syntax
acorn221
acorn221OP•17mo ago
Cheers! I'll get on it when I get home @louisgv I found the problem! it turns out, the CSP doesn't get set if the page requested has the wrong capitals (eg. I was requesting, and then loading the page sandboxes/gapiauth.html, but the CSP was only sent over when I requested sandboxes/GapiAuth.html, as the component is called called GapiAuth.tsx )
acorn221
acorn221OP•17mo ago
GitHub
GitHub - Acorn221/plasmo-csp-case-glitch
Contribute to Acorn221/plasmo-csp-case-glitch development by creating an account on GitHub.
lab
lab•17mo ago
cool beans! Hmm.. casing for page is a bit of a headache lol... I'd suggest for entry file, just use lowercase and -
acorn221
acorn221OP•17mo ago
It's just annoying as it loads the page when the casing is not identical, but it's just the CSP that breaks
lab
lab•17mo ago
Super User
Why are website URLs not case-sensitive?
What was the design choice here? Why are URLs designed to not be case-sensitive? For example: When I type "gaming.stackexchange.com", it will take me to Arqade.SE. If I type "GaminG.StackExchang...
lab
lab•17mo ago
^ yeah there's a whole history there re:URL casing... but the end URI likely are case-insensitive
Want results from more Discord servers?
Add your server