内容表

• 范例
• 浏览器兼容性

content_security_policy

											"content_security_policy": "default-src 'self'"
													

Extensions have a content security policy applied to them by default. The default policy restricts the sources from which they can load <script> and <object> resources, and disallows potentially unsafe practices such as the use of eval() 。见 Default content security policy to learn more about the implications of this.

可以使用 "content_security_policy" manifest key to loosen or tighten the default policy. This key is specified in just the same way as the Content-Security-Policy HTTP header. See Using Content Security Policy for a general description of CSP syntax.

For example, you can use this key to:

• Allow the extension to load scripts and objects from outside its package, by supplying their URL in the script-src or object-src 指令。
• Allow the extension to execute inline scripts, by supplying the hash of the script in the "script-src" directive .
• Allow the extension to use eval() and similar features, by including 'unsafe-eval' 在 script-src 指令。
• Restrict permitted sources for other types of content, such as images and stylesheets, using the appropriate policy directive .

There are restrictions on the policy you can specify here:

• The policy may include just default-src , but if not the policy must include at least the script-src 和 object-src directives, and the script-src directive must contain the keyword 'self' .
• Remote sources must use https: schemes.
• Remote sources must not use wildcards for any domains in the public suffix list (so "*.co.uk" and "*.blogspot.com" are not allowed, although "*.foo.blogspot.com" is allowed).
• All sources must specify a host.
• The only permitted schemes for sources are: blob: , filesystem: , moz-extension: , https: ，和 wss: .
• The only permitted 关键词 是： 'none' , 'self' ，和 'unsafe-eval' .

范例

Valid examples

注意： Valid examples demonstrate the correct use of keys in CSP. However, extensions with 'unsafe-eval', remote script, blob, or remote sources in their CSP are not allowed for Firefox extensions as per the add-on policies and due to major security issues.

Require that all types of content should be packaged with the extension:

												"content_security_policy": "default-src 'self'"
												
									

Allow remote scripts from "https://example.com":

												"content_security_policy": "script-src 'self' https://example.com; object-src 'self'"
												
									

Allow remote scripts from any subdomain of "jquery.com":

												"content_security_policy": "script-src 'self' https://*.jquery.com; object-src 'self'"
												
									

Allow eval() and friends :

												"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self';"
												
									

Allow the inline script: "<script>alert('Hello, world.');</script>" :

												"content_security_policy": "script-src 'self' 'sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng='; object-src 'self'"
												
									

Keep the rest of the policy, but also require that images should be packaged with the extension:

												"content_security_policy": "script-src 'self'; object-src 'self'; img-src 'self'"
												
									

Invalid examples

Policy that omits the "object-src" directive:

												"content_security_policy": "script-src 'self' https://*.jquery.com;"
												
									

Policy that omits the "self" keyword in the "script-src" directive:

												"content_security_policy": "script-src https://*.jquery.com; object-src 'self'"
												
									

Scheme for a remote source is not https :

												"content_security_policy": "script-src 'self' http://code.jquery.com; object-src 'self'"
												
									

Wildcard is used with a generic domain:

												"content_security_policy": "script-src 'self' https://*.blogspot.com; object-src 'self'"
												
									

Source specifies a scheme but no host:

												"content_security_policy": "script-src 'self' https:; object-src 'self'"
												
									

Directive includes the unsupported keyword 'unsafe-inline' :

												"content_security_policy": "script-src 'self' 'unsafe-inline'; object-src 'self'"
												
									

浏览器兼容性

BCD tables only load in the browser

Found a problem with this page?

• Edit on GitHub
• Source on GitHub
• Report a problem with this content on GitHub
• Want to fix the problem yourself? See our Contribution guide .

最后修改： Jan 19, 2022 , 由 MDN 贡献者

相关话题

1. 浏览器扩展名
2. 快速入门

   1. What are extensions?
   2. Your first extension
   3. Your second extension
   4. Anatomy of an extension
   5. Example extensions
   6. What next?
3. 概念

   1. Using the JavaScript APIs
   2. Content scripts
   3. Match patterns
   4. Working with files
   5. 国际化
   6. Content Security Policy
   7. Native messaging
   8. Differences between API implementations
   9. Chrome incompatibilities
4. 用户界面

   1. 用户界面
   2. Toolbar button
   3. Address bar button
   4. Sidebars
   5. Context menu items
   6. Options page
   7. Extension pages
   8. Notifications
   9. Address bar suggestions
   10. Developer tools panels
5. 如何

   1. Intercept HTTP requests
   2. Modify a web page
   3. Insert external content
   4. Share objects with page scripts
   5. Add a button to the toolbar
   6. Implement a settings page
   7. Work with the Tabs API
   8. Work with the Bookmarks API
   9. Work with the Cookies API
   10. Work with contextual identities
   11. Interact with the clipboard
   12. Build a cross-browser extension
6. Firefox differentiators
7. JavaScript API

   1. Browser support for JavaScript APIs
   2. alarms
   3. bookmarks
   4. browserAction
   5. browserSettings
   6. browsingData
   7. captivePortal
   8. clipboard
   9. 命令
   10. contentScripts
   11. contextualIdentities
   12. Cookie
   13. devtools
   14. dns
   15. downloads
   16. events
   17. extension
   18. extensionTypes
   19. find
   20. history
   21. i18n
   22. identity
   23. idle
   24. management
   25. menus
   26. notifications
   27. omnibox
   28. pageAction
   29. permissions
   30. pkcs11
   31. privacy
   32. proxy
   33. runtime
   34. search
   35. sessions
   36. sidebarAction
   37. storage
   38. tabs
   39. theme
   40. topSites
   41. 类型
   42. userScripts
   43. webNavigation
   44. webRequest
   45. windows
8. Manifest keys

   1. 介绍

   1. 作者
   2. background
   3. browser_action
   4. browser_specific_settings
   5. chrome_settings_overrides
   6. chrome_url_overrides
   7. 命令
   8. content_scripts
   9. content_security_policy
   10. default_locale
   11. description
   12. developer
   13. devtools_page
   14. dictionaries
   15. externally_connectable
   16. homepage_url
   17. icons
   18. incognito
   19. manifest_version
   20. name
   21. offline_enabled
   22. omnibox
   23. optional_permissions
   24. options_page
   25. options_ui
   26. page_action
   27. permissions
   28. protocol_handlers
   29. short_name
   30. sidebar_action
   31. storage
   32. theme
   33. theme_experiment
   34. user_scripts
   35. version
   36. version_name
   37. web_accessible_resources
9. Extension Workshop

   1. Develop
   2. Publish
   3. Manage
   4. Enterprise
10. Contact us
11. Channels

    1. Add-ons blog
    2. Add-ons forum
    3. Add-ons chat