javascript - Chrome add-on triggers Content Security Policy violation -


chrome add-on triggers content security policy violation

recently, have started developing chrome add-on inject button github user profiles. add-on designed inject keybase button on github user profiles correspond keybase user profiles shown in image.

keybase button example

my main code written in javascript, can found @ following link:

https://gist.github.com/psgs/10516497

my manifest.json file follows:

https://gist.github.com/psgs/10516524

when code run part of chrome add-on, following error spammed in javascript console, , when pressed, keybase button won't link user user's keybase profile.

javascript console error

any insight why these errors occuring appreciated!!

more information can found @ github issues page keybase button repository.

i've tried run code , couldn't reproduce errors screenshot. button injected ok, when press i'm getting:

xmlhttprequest cannot load https://www.keybase.io/psgs. no 'access-control-allow-origin' header present on requested resource. origin 'https://github.com' therefore not allowed access. psgs:1 ajax error github-a1fec3e73d87f3550c635e371c8519308940f4b4.js:1

here think happening:

  • when button clicked event captured github javascript code , converted kind of ajax request.
  • this request doesn't work because www.keybase.io doesn't allow requests different origin.

you can try add our click handler button, stop event bubbling github handler this:

button     .attr('href', 'https://www.keybase.io/' + username)     .html('<span class="octicon octicon-key"></span>keybase')     .click(function() {window.location = 'https://www.keybase.io/' + username}) 

anyway it's not quite clear trying achieve.


Comments

Popular posts from this blog

apache - Remove .php and add trailing slash in url using htaccess not loading css -

javascript - jQuery show full size image on click -