How to use Firebase CDN in Chrome Extension bypassing CSP restrictions

Question

Scenario

I have been trying to use Firebase CDN for my Chrome Extension. When I try to do that, I get an error stating that the CSP is not allowing inline Javascript to execute.

Error

The CSP has blocked inline Javascript, stating that XSS is possible. While I don't want that to happen, I do want to implement Firebase.

Work done so far

First, I tried creating a nonce with a meta tag. That didn't work. Then I tried exporting it to another file, but it tells me script-src blocked the Javascript.

So, what I'm I supposed to do?

And possibly my question is a duplicate of: https://stackoverflow.com/questions/8502307/chrome-version-18-how-to-allow-inline-scripting-with-a-content-security-policy?rq=1 — Jandroid, Nov 11 '22 at 07:20

score 1 · Accepted Answer · answered Nov 10 '22 at 09:32

1

MV3 doesn't support remote hosted code anymore so everything should be bind inside extension package. Please let me know any questions after reading this. https://gist.github.com/cheadrian/8424217dda5a28724f290eef7fb4e059

answered Nov 10 '22 at 09:32

Top

95
4

How to use Firebase CDN in Chrome Extension bypassing CSP restrictions

Scenario

Error

Work done so far

1 Answers1