8 ms·
Can you provide an example of the website which makes it impossible to insert JS from extension? I'd like to tinker with it. I wrote a simple extension which in
by vbezhenar 5y ago
Can you provide an example of the website which makes it impossible to insert JS from extension? I'd like to tinker with it. I wrote a simple extension which inserted JS to youtube and it worked just fine. I thought youtube is secure enough?
- deleted 5y ago[deleted]
- Ajedi32 5y agoYouTube does not (currently) send CSP headers from what I can see in the dev tools. Hacker News does, but it specifies "unsafe-inline" which negates most of the protection. Not aware of any sites with more locked down policies off the top of my head; it's not exactly an advertised feature of most sites.
- deleted 5y ago[deleted]
- rini17 5y agoGitHub
- qvq 5y agoFor a Chrome extension using manifest V2: you can inject "inline" scripts into the DOM and interact with a page's JS regardless of the CSP. For a Chrome extension using manifest v3: you can inject script tags with a src pointing to a local JS file in the extension regardless of the CSP. Modifying the CSP is not a requirement for a Chrome extension to interact with a page's JS. I don't know about other browsers though.
- g3rv4 5y agoslack. I do so with my extension[0]. At one point they rewrote it and added CSP. In order to inject my code before theirs, I had to come up with different approaches on FF and Chrome... and since it was starting to become a cat and mouse game, I just took the extension private. After that, they didn't escalate their game. I'm thankful for that, so that I can keep enjoying it without spending lots of time figuring out how to mess with it. [0] https://refined.chat https://refined.chat