Chrome app content security policy issue

Question

I'm trying to build a chrome app that embeds Youtube content but facing this error while using some scripts : "Refused to load the script 'https://www.youtube.com/iframe_api' because it violates the following Content Security Policy directive: "default-src 'self' chrome-extension-resource:". Note that 'script-src' was not explicitly set, so 'default-src' is used as a fallback."

I've followed the documentation as long i tried to look around the web and found out i needed to loosen the CSP. Here is my manifest.json

{    
    ...

    "permissions": ["https://*.youtube.com"],
    "content_security_policy": "script-src 'self' https://*.youtube.com; object-src 'self'"

}

but i still have the same error. What am i doing wrong?

Xan Xan · Accepted Answer · 2015-05-04T11:51:28

You cannot override CSP for apps. The reference you found was for extensions.

Your options are limited to <webview> embedding and sandboxing.

Chrome app content security policy issue

1 Answers