invoke firebase api from chrome extension

Question

I'm trying to call the set method of the firebase api from a chrome extension. Since I was having issues loading the firebase.js from the cdn I decided to download it and include it in my package. But now I'm getting:

Refused to load the script 'https://mydomain.firebaseio.com/.lp?start=t&ser=323&cb=1&v=5' because it violates the following Content Security Policy directive: "default-src 'self' blob: filesystem: chrome-extension-resource:". Note that 'script-src' was not explicitly set, so 'default-src' is used as a fallback. (anonymous function) @ firebase241.js:168 firebase241.js:168 Refused to load the script

When the firebase script executes. I know it is something related to permissions or content_security_policy from my extensionmanifest. But I've tried doing this:

"content_security_policy": "script-src 'self' https://mydomain.firebaseio.com/; object-src 'self'",

and that:

  "permissions": [
    "gcm",
    "storage",
    "notifications",
    "https://*.firebase.com/",
    "https://cdn.firebase.com/js/client/2.4.1/firebase.js",
    "https://mydomain.firebaseio.com/*",
  ],

with no luck.

I'm also getting this:

There were warnings when trying to install this extension: 'content_security_policy' is only allowed for extensions and legacy packaged apps, but this is a packaged app.

when I set the content_security_policy in the manifest.js

"content_security_policy": "script-src 'self' https://mydomain.firebaseio.com/; object-src 'self'"

Xan Xan · Accepted Answer · 2016-03-01T01:12:33

'content_security_policy' is only allowed for extensions and legacy packaged apps, but this is a packaged app

What you have is not an extension, but an app. Which is defined by having an "app" key in the manifest.

Apps cannot override CSP.

You need to solve this identity crisis:

If you really mean to have an extension, you need to remove "app" key and make a real extension.
If you're confused about terminology and you really mean to write a Chrome App, the proper approach is sandboxing.

invoke firebase api from chrome extension

2 Answers