javascript - Chrome add-on triggers Content Security Policy violation -
chrome add-on triggers content security policy violation
recently, have started developing chrome add-on inject button github user profiles. add-on designed inject keybase button on github user profiles correspond keybase user profiles shown in image.
my main code written in javascript, can found @ following link:
https://gist.github.com/psgs/10516497
my manifest.json file follows:
https://gist.github.com/psgs/10516524
when code run part of chrome add-on, following error spammed in javascript console, , when pressed, keybase button won't link user user's keybase profile.
any insight why these errors occuring appreciated!!
more information can found @ github issues page keybase button repository.
i've tried run code , couldn't reproduce errors screenshot. button injected ok, when press i'm getting:
xmlhttprequest cannot load https://www.keybase.io/psgs. no 'access-control-allow-origin' header present on requested resource. origin 'https://github.com' therefore not allowed access. psgs:1 ajax error github-a1fec3e73d87f3550c635e371c8519308940f4b4.js:1
here think happening:
- when button clicked event captured github javascript code , converted kind of ajax request.
- this request doesn't work because www.keybase.io doesn't allow requests different origin.
you can try add our click
handler button, stop event bubbling github handler this:
button .attr('href', 'https://www.keybase.io/' + username) .html('<span class="octicon octicon-key"></span>keybase') .click(function() {window.location = 'https://www.keybase.io/' + username})
anyway it's not quite clear trying achieve.
Comments
Post a Comment