chrome 扩展权限不起作用

Question

我的 chrome 扩展的结构是这样的：

background.html
background.js
javascripts/angular...
javascripts/webRTC...

在 background.js 中，我使用了来自 firebase 的 datachannel.js 库，它实质上创建了对 firebaseio.com 的远程调用

var socket = new window.Firebase('https://' + 
    (self.firebase || 'webrtc-experiment') + '.firebaseIO.com/' + channel);

chrome 将此错误返回到控制台：

Refused to load the script 'https://webrtc-experiment.firebaseio.com/.lp?start=t&ser=24080204&cb=23&v=5' because it violates the following Content Security Policy directive: "script-src 'self' blob: filesystem: chrome-extension-resource:". (anonymous function) @ firebase.js:168

这是 manifest.json：

 "manifest_version": 2,
    "background": {
        "page": "background.html"
    },
    "browser_action": {
        "default_popup": "main.html",
        "default_icon": "icon.png",
        "default_title": "title"

    },
    "minimum_chrome_version": "37.0",
    "name": "chromeextensionname",
    "permissions": [
        "<all_urls>",

Answer 1

content-security-policy在 manifest.json 中解决

"content_security_policy": "script-src 'self' https://*.firebase.com https://*.firebaseio.com; object-src 'self'",

参考：

https://developer.chrome.com/extensions/contentSecurityPolicy

如何在 Chrome Extension Manifest.json 中设置内容安全策略以使 Firebase 正常工作