2 ms·
One of the possible workarounds would be to just remove the damn header before it causes any further inconvenience. I think they do allow `webRequest` API usage
by gear54rus 2y ago
One of the possible workarounds would be to just remove the damn header before it causes any further inconvenience. I think they do allow `webRequest` API usage in the store, don't they?
- evilpie 2y agoRemoving security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy. https://extensionworkshop.com/documentation/publish/add-on-policies/#development-practices https://extensionworkshop.com/documentation/publish/add-on-p...
- gear54rus 2y agoI don't think this is being enforced in practice, thankfully.
- davidmurdoch 2y agoIt is. It happened to us a few weeks ago.
- gear54rus 2y agoThat's crazy. Did it happen to a public extension or an unlisted one?
- davidmurdoch 2y agoPublic, with about half a million installations. I think it was noticed only because this version had a major bug that broke a bunch of websites.
- davidmurdoch 2y agoWe modified the CSP to inject a per user generated nonce that exempts it script from the policy. They said this was not allowed and removed it from the extension store.