# Content\_security\_policy not work in my extension

**URL:** <https://discourse.mozilla.org/t/content-security-policy-not-work-in-my-extension/95401>\
**Category:** Add-on Support\
**Created:** [April 2, 2022, 4:01am UTC](https://discourse.mozilla.org/t/content-security-policy-not-work-in-my-extension/95401 "2022-04-02T04:01:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tolerious](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/tolerious/32/55640_2.png) [@tolerious](https://discourse.mozilla.org/u/tolerious)\
**Post date:** [April 2, 2022, 4:01am UTC](https://discourse.mozilla.org/t/content-security-policy-not-work-in-my-extension/95401/1 "2022-04-02T04:01:46Z")

</div>

In my content script I make a XHR request to get a audio url for my Audio() object to play. But in [developer.mozilla.org](http://developer.mozilla.org) webpage, I got a CSP warning, and the audio can not be played.  
so ,in my `manifest.json` file, I just rewrite the default CSP police like this

```auto
  "content_security_policy": "script-src 'self' ; media-src https://openapi.youdao.com/; object-src 'self' *://*.youdao.com/*"

```

but it seems not work, I still got the CSP warning.  
and this is my audio url `https://openapi.youdao.com/ttsapi?q=once&langType=en&sign=DF8808E04044C6900DF696ED44D0DC8D&salt=1648873379040&voice=4&format=mp3&appKey=30b3aa18e38ef10f&ttsVoiceStrict=false `

---

<div class="post-metadata">

**Author:** ![juraj.masiar](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/juraj.masiar/32/30587_2.png) [@juraj.masiar](https://discourse.mozilla.org/u/juraj.masiar)\
**Post date:** [April 2, 2022, 2:21pm UTC](https://discourse.mozilla.org/t/content-security-policy-not-work-in-my-extension/95401/2 "2022-04-02T14:21:35Z")

</div>

Web pages will have all kinds of CSP that will mess up your content script.

What should help is inject an “iframe” into the page and load your extension page (some “audio.html” file) into the iframe, then call the audio code in the iframe page.  
That way the CSP of the page won’t apply to the code running inside the iframe.

Also, using CSP in the manifest file is dangerous and your addon may not pass review. So make sure to read this:

> **[content\_security\_policy - Mozilla | MDN](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy#invalid_examples)**
>
> Extensions have a content security policy (CSP) applied to them by default. The default policy restricts the sources from which extensions can load code (such as

---

<div class="post-metadata">

**Author:** ![tolerious](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/tolerious/32/55640_2.png) [@tolerious](https://discourse.mozilla.org/u/tolerious)\
**Post date:** [April 2, 2022, 2:41pm UTC](https://discourse.mozilla.org/t/content-security-policy-not-work-in-my-extension/95401/3 "2022-04-02T14:41:25Z")

</div>

OK，I will try this method. Thanks a lot.

---

<div class="post-metadata">

**Author:** ![tolerious](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/tolerious/32/55640_2.png) [@tolerious](https://discourse.mozilla.org/u/tolerious)\
**Post date:** [April 2, 2022, 3:29pm UTC](https://discourse.mozilla.org/t/content-security-policy-not-work-in-my-extension/95401/4 "2022-04-02T15:29:36Z")

</div>

by the way, could I use the `shadow dom` tech to solve this problem?

---

<div class="post-metadata">

**Author:** ![juraj.masiar](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/juraj.masiar/32/30587_2.png) [@juraj.masiar](https://discourse.mozilla.org/u/juraj.masiar)\
**Post date:** [April 2, 2022, 3:38pm UTC](https://discourse.mozilla.org/t/content-security-policy-not-work-in-my-extension/95401/5 "2022-04-02T15:38:26Z")

</div>

I don’t think that will help. It will encapsulate the HTML and CSS of the injected HTML but it doesn’t change the fact that your content script is being executed on the 3rd party webpage powered by CSP.  
Unlike with iframe where your code is being executed as on the extension page, so the content\_script limitations doesn’t apply anymore.

But I know, using iframe is not easy at all. For example if you want to send the iframe a message from the parent tab, you will have to send it first to background script and then forward it back to tab.