CODEWITHSUNDEEP
google-chrome-extension
Yureshwar Ravuri
Yureshwar Ravuri

Reputation: 11

Reading Content Security Policy header with Manifest 3 - chrome extension

We are working on an Open Source Chrome extension: Digital Assistant Client

We are trying to read and modify the "content security policy" header with chrome extension in manifest 3. We are using the declarativeNetRequest api for modification with append operation to allow our domains for fetching and posting data. In manifest v2 it is easy to read the header values by using

chrome.webRequest.onHeadersReceived.addListener( onHeadersReceived, onHeaderFilter, ['blocking', 'responseHeaders'] );

How can we acheive this in manifest 3 for reading the headers?

I have tried by defining the rules.json as given below

[ { "id": 1, "action": { "type": "modifyHeaders", "responseHeaders": [ { "header": "content-security-policy", "operation": "append", "value": "connect-src udan.nistapp.ai udantest.nistapp.ai" } ] }, "condition": { "resourceTypes": [ "csp_report", "font", "image", "main_frame", "media", "object", "other", "ping", "script", "stylesheet", "sub_frame", "webbundle", "websocket", "webtransport", "xmlhttprequest" ] } } ]

and in manifest as given below

.... permissions": [ .... "declarativeNetRequest", "declarativeNetRequestWithHostAccess", "declarativeNetRequestFeedback", ], "declarative_net_request": { "rule_resources": [{ "id": "csp_rules", "enabled": true, "path": "rules.json" }] }, ....

Problem:

When i try to append the value to the original, connect-src is getting overridden. So i want to read the header values such that i can modify the existing values. Is there a way for acheiving this?

Upvotes: 1

Views: 472

Answers (1)

Oliver Dunk
Oliver Dunk

Reputation: 524

The code you have looks good for modifying the CSP header. With that in mind, there are two common gotchas which you might be running in to:

  • Certain DNR rules that access or modify request/response data require host permissions. Make sure you have the host_permissions key set in the manifest with the hosts you wish to act on.
  • Modifications to headers made with DNR are not shown in Dev Tools (https://bugs.chromium.org/p/chromium/issues/detail?id=1247400). Doing a fetch request from the console and logging headers can help, or using the (development only) onRuleMatchedDebug API to see if your rule has been run.

Upvotes: 0

Related Questions