MDN’s new design is in Beta! A sneak peek:

Type String
Mandatory No
"content_security_policy": "default-src 'self'"

WebExtensions have a content security policy applied to them by default. The default policy restricts the sources from which they can load<script> and <object> resources, and disallows potentially unsafe practices such as the use of eval(). See Default content security policy to learn more about the implications of this.

You can use the "content_security_policy" manifest key to loosen or tighten the default policy. This key is specified in just the same way as the Content-Security-Policy HTTP header. See Using Content Security Policy for a general description of CSP syntax.

For example, you can use this key to:

There are restrictions on the policy you can specify here:

  • The policy must include at least the script-src and the object-src directives, and the script-src directive must contain the keyword 'self'.
  • Remote sources must use https: schemes.
  • Remote sources must not use wildcards for any domains in the public suffix list (so "*" and "*" are not allowed, although "*" is allowed).
  • All sources must specify a host.
  • The only permitted schemes for sources are: blob:, filesystem:, moz-extension:, and https:.
  • The only permitted keywords are: 'none', 'self', and 'unsafe-eval'.


Valid examples

Allow remote scripts from "": (see note 1 )

"content_security_policy": "script-src 'self'; object-src 'self'"

Allow remote scripts from any subdomain of "":

"content_security_policy": "script-src 'self' https://*; object-src 'self'"

Allow eval() and friends:

"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self';"

Allow the inline script: "<script>alert('Hello, world.');</script>":

"content_security_policy": "script-src 'self' 'sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng='; object-src 'self'"

Keep the rest of the policy, but also require that images should be packaged with the add-on:

"content_security_policy": "script-src 'self'; object-src 'self'; img-src 'self'"

Require that all types of content should be packaged with the add-on:

"content_security_policy": "default-src 'self'"

Invalid examples

Policy that omits the "object-src" directive:

"content_security_policy": "script-src 'self' https://*;"

Policy that omits the "self" keyword in the "script-src" directive:

"content_security_policy": "script-src https://*; object-src 'self'"

Scheme for a remote source is not https:

"content_security_policy": "script-src 'self'; object-src 'self'"

Wildcard is used with a generic domain:

"content_security_policy": "script-src 'self' https://*; object-src 'self'"

Source specifies a scheme but no host:

"content_security_policy": "script-src 'self' https:; object-src 'self'"

Directive includes the unsupported keyword 'unsafe-inline':

"content_security_policy": "script-src 'self' 'unsafe-inline'; object-src 'self'"

1. Note: Valid examples display the correct use of keys in CSP. However, extensions with 'unsafe-eval', 'unsafe-inline', remote script, or remote sources in their CSP are not allowed for add-ons listed on due to major security issues.



Browser compatibility

ChromeEdgeFirefoxFirefox for AndroidOpera
Basic supportYesYes 148 248 2Yes
1. Only the default content security policy is supported: "script-src 'self'; object-src 'self';".
2. Firefox does not support '' or 'http://localhost' as script sources: they must be served over HTTPS.

Document Tags and Contributors

 Contributors to this page: erosman, wbamberg, fscholz, Makyen, kmaglione
 Last updated by: erosman,