# WebExtension Github CSP Issue

**URL:** <https://discourse.mozilla.org/t/webextension-github-csp-issue/8652>\
**Category:** Development\
**Created:** [May 13, 2016, 4:40am UTC](https://discourse.mozilla.org/t/webextension-github-csp-issue/8652 "2016-05-13T04:40:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![irtza\_qc](https://avatars.discourse-cdn.com/v4/letter/i/e9bcb4/32.png) [@irtza\_qc](https://discourse.mozilla.org/u/irtza_qc)\
**Post date:** [May 13, 2016, 4:40am UTC](https://discourse.mozilla.org/t/webextension-github-csp-issue/8652/1 "2016-05-13T04:40:36Z")

</div>

I’m trying to convert a Chrome extension into Firefox WebExtension. Its worked out fine so far, but for some reason, I’m facing an issue with GitHub. My Extension adds a small div to the side of the page, but when I try to add it to GitHub, I get the error

`Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src https://assets-cdn.github.com").`

I’m not sure why though, because in my manifest.json I have set the CSP to be

`"content_security_policy": "script-src 'self' 'unsafe-eval' 'unsafe-inline'; object-src 'self'; font-src 'self' data:;"`

I’d appreciate any advice on this issue. Its working fine on Chrome as is.

---

<div class="post-metadata">

**Author:** ![jorgev](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@jorgev](https://discourse.mozilla.org/u/jorgev)\
**Post date:** [May 17, 2016, 9:56pm UTC](https://discourse.mozilla.org/t/webextension-github-csp-issue/8652/2 "2016-05-17T21:56:05Z")

</div>

You’re most likely running into [this bug](https://bugzilla.mozilla.org/show_bug.cgi?id=1267027). It hasn’t been fixed in the API yet.

---

<div class="post-metadata">

**Author:** ![irtza\_qc](https://avatars.discourse-cdn.com/v4/letter/i/e9bcb4/32.png) [@irtza\_qc](https://discourse.mozilla.org/u/irtza_qc)\
**Post date:** [May 19, 2016, 4:27am UTC](https://discourse.mozilla.org/t/webextension-github-csp-issue/8652/3 "2016-05-19T04:27:29Z")

</div>

Any idea when it will be fixed?

---

<div class="post-metadata">

**Author:** ![jorgev](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@jorgev](https://discourse.mozilla.org/u/jorgev)\
**Post date:** [May 24, 2016, 7:22pm UTC](https://discourse.mozilla.org/t/webextension-github-csp-issue/8652/4 "2016-05-24T19:22:30Z")

</div>

It has a low priority at the moment, so it will probably won’t make the initial release of WebExtensions in Firefox 48.