# Extension: playing audio from IndexedDB: "Content Security Policy: The page’s settings blocked the loading of a resource at blob:moz-extension://c2eb02dd-4249-724d-a725-286299b78933/7b5dea1e-5e40-b645-8217-49618e0d333a (“media-src”)."

**URL:** <https://discourse.mozilla.org/t/extension-playing-audio-from-indexeddb-content-security-policy-the-page-s-settings-blocked-the-loading-of-a-resource-at-blob-c2eb02dd-4249-724d-a725-286299b78933-7b5dea1e-5e40-b645-8217-49618e0d333a-media-src/31083>\
**Category:** Development\
**Created:** [August 20, 2018, 4:33pm UTC](https://discourse.mozilla.org/t/extension-playing-audio-from-indexeddb-content-security-policy-the-page-s-settings-blocked-the-loading-of-a-resource-at-blob-c2eb02dd-4249-724d-a725-286299b78933-7b5dea1e-5e40-b645-8217-49618e0d333a-media-src/31083 "2018-08-20T16:33:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zdanevich-vitaly](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/zdanevich-vitaly/32/23412_2.png) [@zdanevich-vitaly](https://discourse.mozilla.org/u/zdanevich-vitaly)\
**Post date:** [August 20, 2018, 4:33pm UTC](https://discourse.mozilla.org/t/extension-playing-audio-from-indexeddb-content-security-policy-the-page-s-settings-blocked-the-loading-of-a-resource-at-blob-c2eb02dd-4249-724d-a725-286299b78933-7b5dea1e-5e40-b645-8217-49618e0d333a-media-src/31083/1 "2018-08-20T16:33:34Z")

</div>

But the same code works correctly in Chrome.

My code:

```
const request = window.indexedDB.open('my-database-name');
request.onsuccess = function(event) {
    const db = event.target.result;
    const objectStore = db.transaction(['audio']).objectStore('audio');
    const request = objectStore.get('my-id');
    request.onsuccess = function() {
        const url = URL.createObjectURL(request.result['blob']);
        const audio = new Audio(url);
        audio.play();
    };
};

```

I tried to add to `manifest.json` in CSP into `media-src`: `moz-extension://c2eb02dd-4249-724d-a725-286299b78933/` without success.

Is it correct behaviour of Firefox? Is it workaroundable?

---

<div class="post-metadata">

**Author:** ![NilkasG](https://avatars.discourse-cdn.com/v4/letter/n/0ea827/32.png) [@NilkasG](https://discourse.mozilla.org/u/NilkasG)\
**Post date:** [August 20, 2018, 5:03pm UTC](https://discourse.mozilla.org/t/extension-playing-audio-from-indexeddb-content-security-policy-the-page-s-settings-blocked-the-loading-of-a-resource-at-blob-c2eb02dd-4249-724d-a725-286299b78933-7b5dea1e-5e40-b645-8217-49618e0d333a-media-src/31083/2 "2018-08-20T17:03:49Z")

</div>

If anything, you’d need to add `media-src: blob:` to the CSP (and might still want to include `self`).

The `blob:` protocol is always already restricted to the current origin.