# \[Blog post\] Test the new Content Security Policy for Content Scripts

**URL:** <https://discourse.mozilla.org/t/blog-post-test-the-new-content-security-policy-for-content-scripts/50245>\
**Category:** Announcements\
**Created:** [December 12, 2019, 5:09pm UTC](https://discourse.mozilla.org/t/blog-post-test-the-new-content-security-policy-for-content-scripts/50245 "2019-12-12T17:09:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![caitlin](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/caitlin/32/6091_2.png) [@caitlin](https://discourse.mozilla.org/u/caitlin)\
**Post date:** [December 12, 2019, 5:09pm UTC](https://discourse.mozilla.org/t/blog-post-test-the-new-content-security-policy-for-content-scripts/50245/1 "2019-12-12T17:09:12Z")

</div>

Hi all,

As part of our efforts to make add-ons safer for users, and to support evolving [manifest v3](https://blog.mozilla.org/addons/2019/09/03/mozillas-manifest-v3-faq/) features, we are making changes to apply the [Content Security Policy](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy#Default_content_security_policy) (CSP) to content scripts used in extensions.

You can see how your extension will be affected by testing this feature in Nightly or Beta. For more information, please see the [Add-ons Blog](https://blog.mozilla.org/addons/2019/12/12/test-the-new-csp-for-content-scripts).

---

<div class="post-metadata">

**Author:** ![freaktechnik](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/freaktechnik/32/37766_2.png) [@freaktechnik](https://discourse.mozilla.org/u/freaktechnik)\
**Post date:** [December 12, 2019, 7:14pm UTC](https://discourse.mozilla.org/t/blog-post-test-the-new-content-security-policy-for-content-scripts/50245/2 "2019-12-12T19:14:17Z")

</div>

I may have just missed it, but what’s the CSP for content scripts with this change? The same as the one that currently applies to extension pages by default? And what does no remote scripts mean for content scripts? Since content scripts aren’t really html pages… Or is it that they can’t inject script tags that load a script from remote resource?

---

<div class="post-metadata">

**Author:** ![mixedpuppy](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/mixedpuppy/32/32541_2.png) [@mixedpuppy](https://discourse.mozilla.org/u/mixedpuppy)\
**Post date:** [December 13, 2019, 5:15pm UTC](https://discourse.mozilla.org/t/blog-post-test-the-new-content-security-policy-for-content-scripts/50245/3 "2019-12-13T17:15:22Z")

</div>

> The same as the one that currently applies to extension pages by default?

Yes, it is currently the same as applied to extension pages. That will change soon.

> And what does no remote scripts mean for content scripts?

When the above mentioned change happens, loosening the default CSP will not allow the addition of accessing remote resources via e.g. http and ftp.

---

<div class="post-metadata">

**Author:** ![grahamperrin](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/grahamperrin/32/17266_2.png) [@grahamperrin](https://discourse.mozilla.org/u/grahamperrin)\
**Post date:** [December 26, 2019, 7:23pm UTC](https://discourse.mozilla.org/t/blog-post-test-the-new-content-security-policy-for-content-scripts/50245/4 "2019-12-26T19:23:52Z")

</div>

Drawing attention to this, from the blog post:

> … upcoming changes to [disallow remote scripts](https://bugzilla.mozilla.org/show_bug.cgi?id=1594234). …

I suspect that despite the early warning, it will take a few developers by surprise.

At and under [https://bugzilla.mozilla.org/show\_bug.cgi?id=1594234#c0](https://bugzilla.mozilla.org/show_bug.cgi?id=1594234#c0):

> Developers can no longer use CSP directives that enable remotely hosted code (code that is not bundled with the extension). Manifests that include such directives will error at parse time. …

> This will require two sets of csp defaults, one for v2 and one for v3. As well, if [bug 1594235](https://bugzilla.mozilla.org/show_bug.cgi?id=1594235) is implemented, we’ll need a separate set for that.

– Mozilla bug [1594235 - consider supporting content\_security\_policy.sandbox](https://bugzilla.mozilla.org/show_bug.cgi?id=1594235)

* * *

Via [https://bugzilla.mozilla.org/showdependencytree.cgi?id=1581608&hide\_resolved=0](https://bugzilla.mozilla.org/showdependencytree.cgi?id=1581608&hide_resolved=0):

- [1578284 - (manifest-v3) [meta] Manifest v3](https://bugzilla.mozilla.org/show_bug.cgi?id=1578284)

If [https://bugzilla.mozilla.org/show\_bug.cgi?id=1578284#c2](https://bugzilla.mozilla.org/show_bug.cgi?id=1578284#c2) is misplaced, please hide or delete it.

HTH

---

<div class="post-metadata">

**Author:** ![Grand\_Canyon\_Destinations](https://avatars.discourse-cdn.com/v4/letter/g/74df32/32.png) [@Grand\_Canyon\_Destinations](https://discourse.mozilla.org/u/Grand_Canyon_Destinations)\
**Post date:** [February 16, 2020, 2:05pm UTC](https://discourse.mozilla.org/t/blog-post-test-the-new-content-security-policy-for-content-scripts/50245/5 "2020-02-16T14:05:46Z")

</div>

hmm I agree never ready even with the warnings