Refuse to connect to [url] because it violates the following content security policy directive

Question

I am the author of the Chrome extension, which allows you to translate status updates and comments directly to Facebook: https://chrome.google.com/webstore/detail/facebook-translate/plofenifjagmdikfcobngnfmmnfmphin

For several days, my users and I receive an error message in the error console:

Unsubscribe from https://api.microsofttranslator.com/V2/Http.svc/Translate?appId=&text=Chrome-Integration%3A+Google+bringt+Google+Now+auf+Desktop-PCs&to=en&contentType=text% 2Fhtml 'because it violates the following content security policy directive: "connect-src https: //. Facebook.com http: //.facebook.com https: //.fbcdn.net http: //.fbcdn.net *. facebook.net.spotilocal.com: https: //.akamaihd.net ws: //. facebook.com:* http: //*.akamaihd.net ".

In my chrome extension, I set the content security policy as follows:

"content_security_policy": "script -src 'self' https://ssl.google-analytics.com ; object-src 'self'"

The URIs in the error console, however, are FB URIs only so that why I think Facebook has updated its site to restrict access to remote URIs. I'm not sure if this could be a Chrome issue, so sorry if I started the topic on the wrong stackoverflow network. :)

Can someone confirm (and possibly point me to a possible solution) for this problem? Thanks everyone!

Answer 1

Extensions should bypass the Content Security Policy page when executing XMLHTTPRequest from the contents of the script. Currently they are not, which is a mistake. I registered https://bugs.webkit.org/show_bug.cgi?id=104480 to take a look at its fix.

Is XHR running from your contents of the script extension, or are you running it on the original page? The latter should work right now.

Answer 2

The error message says that you are trying to connect to https: // api. microsofttranslator .com / domain, which is not specified in the connect-src of the CSP Directive

It seems you pointed

 "connect-src https://.facebook.com http://.facebook.com https://.fbcdn.net http://.fbcdn.net *.facebook.net .spotilocal.com: https://.akamaihd.net ws://.facebook.com:* http://*.akamaihd.net". 

the above domains for connect-src , add the new microsofttranslator .com domain, if valid.

Let me know if you need more information.