Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Lately, some websites such as Facebook use the Content Security Policy (CSP) to restrict loading of scripts from "untrusted sources". For example, when requesting Facebook HTML content (e.g. ), Facebook's HTTP response includes the following response header:

x-webkit-csp:default-src *;script-src https://* http://* https://* http://* * * * ** ** chrome-extension://lifbcibllhkdhoafpjfnlhfpfgnpldfl 'unsafe-inline' 'unsafe-eval' https://* http://*;style-src * 'unsafe-inline';connect-src https://* http://* https://* http://* * ** https://* ws://** http://*;

This has impact on some bookmarklets which require to load and execute Javascript libraries from untrusted sources.

For example, whenever I try to run the Show Anchors bookmarklet on a Facebook page, execution of this bookmarklet fails as it tries to load jQuery from an untrusted source. In Chrome's Developer console, it will say:

Refused to load the script '' because it violates the following Content Security Policy directive: "script-src https://* http://* https://* http://* * * * ** ** chrome-extension://lifbcibllhkdhoafpjfnlhfpfgnpldfl 'unsafe-inline' 'unsafe-eval' https://* http://*".

I've found a Chrome documentation page about this topic, but it only applies to Chrome extensions.

I'm looking for solutions that allow me to

  • either for a single time deactivate CSP
  • or permanently whitelist my trusted sources.
share|improve this question
This might be helpful. – Rudie Oct 25 '14 at 16:21
@Rudie Will that work for Chrome Mobile? – Michael Dec 30 '14 at 23:31
@Michael If Chrome Mobile supports modern-ish extensions. The WeRequest is kind of new. I don't use Chrome Mobile, so I've no idea. – Rudie Dec 31 '14 at 0:10

2 Answers 2

You can edit these settings in the content tab. You can white list specific domains on specific content types.

share|improve this answer
Where exactly in content settings do I do this, and how? I tried adding my site to the "cookie and site data exceptions" to no effect. None of the other settings seem relevant. – Michael Mar 21 at 20:26

Methods Endorsed by Chrome Apps

Use templating libraries

Use a library that offers precompiled templates and you’re all set. You can still use a library that doesn’t offer precompilation, but it will require some work on your part and there are restrictions.

You will need to use sandboxing to isolate any content that you want to do ‘eval’ things to. Sandboxing lifts CSP on the content that you specify.

Sandbox local content

Sandboxing allows specified pages to be served in a sandboxed, unique origin. These pages are then exempt from their Content Security Policy. Sandboxed pages can use iframes, inline scripting, and eval() (and the last two are the ones being prevented). That'll fix 'unsafe-inline' and 'unsafe-eval'.

  • Use inline scripts in sandbox
  • Include sandbox in manifest

Access remote resources

You can fetch remote resources via XMLHttpRequest and serve them via blob:, data:, or filesystem: URLs. This should fix the jQuery fetching issue.

Manifest requirement

To be able to do cross-origin XMLHttpRequests, you'll need to add a permission for the remote URL's host.

Cross-origin XMLHttpRequest

Fetch the remote URL into the app and serve its contents as a blob: URL.

I don't think you can do any of these. To fix the unsafe-eval and unsafe-inline response headers, only the script owner can fix the code or if it's in public domain, you can fix it. All this is probably a one-time fix.



Content Script Injection

The hacks however have downsides because they've known to cause security holes atleast the first one, definitely.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.