1. Mozilla
  2. Add-ons
  3. Browser extensions
  4. manifest.json
  5. content_security_policy

content_security_policy

Type String
Mandatory No
Manifest version 2 or higher
Example Manifest V2:
json
"content_security_policy": "default-src 'self'"
Manifest V3:
json
"content_security_policy": {
  "extension_pages": "default-src 'self'"
}

Extensions have a content security policy (CSP) applied to them by default. The default policy restricts the sources from which extensions can load code (such as <script> resources) and disallows potentially unsafe practices such as the use of eval(). See Default content security policy to learn more about the implications of this.

You can use the "content_security_policy" manifest key to loosen or tighten the default policy. This key is specified in the same way as the Content-Security-Policy HTTP header. See Using Content Security Policy for a general description of CSP syntax.

For example, you can use this key to:

  • Restrict permitted sources for other types of content, such as images and stylesheets, using the appropriate policy directive.
  • Allow the extension to take advantage of WebAssembly by including the 'wasm-unsafe-eval' source in the script-src directive.
  • Loosen the default script-src policies (Manifest V2 only):

There are restrictions on the policy you can specify with this manifest key:

  • The script-src directive must include at least the 'self' keyword and may only contain secure sources. The set of permitted secure sources differs between Manifest V2 and Manifest V3.
  • The policy may include default-src alone (without script-src) if its sources meet the requirement for the script-src directive.
  • The object-src keyword may be required, see object-src directive for details.
  • Directives that reference code – script-src, script-src-elem, worker-src, and default-src (if used as a fallback) – share the same secure source requirement. There are no restrictions on CSP directives that cover non-script content, such as img-src.

In Manifest V3, all CSP sources that refer to external or non-static content are forbidden in CSP directives covering script content. The only permitted values are 'none', 'self', and 'wasm-unsafe-eval'. There is an exception for scripts from localhost during development; see Scripts from localhost in Content Security Policy for more information.

In Manifest V2, a source for a script directive is considered secure if it meets these criteria:

  • Wildcard hosts are not permitted, such as "script-src 'self' *".
  • Remote sources must use https: schemes.
  • Remote sources must not use wildcards for any domains in the public suffix list (so *.co.uk and *.blogspot.com are not allowed, although *.foo.blogspot.com is permitted).
  • All sources must specify a host.
  • The only permitted schemes for sources are blob:, filesystem:, moz-extension:, https:, and wss:.
  • The only permitted keywords are: 'none', 'self', 'unsafe-eval', and 'wasm-unsafe-eval'.

object-src directive

The object-src directive may be required in some browsers that support obsolete plugins and should be set to a secure source such as 'none' if needed. This may be necessary for browsers up until 2022.

  • In Firefox, "object-src" is optional from Firefox 106. In earlier versions, if "object-src" isn't specified, "content_security_policy" is ignored and the default CSP is used.
  • In Chrome, "object-src" is required. If it's missing or deemed insecure, the default ("object-src 'self'") is used and a warning message logged.
  • In Safari, there is no requirement for "object-src".

See W3C WebExtensions Community Group issue 204, Remove object-src from the CSP, for more information.

Manifest V2 syntax

In Manifest V2, there is one content security policy specified against the key like this:

json
"content_security_policy": "default-src 'self'"

Manifest V3 syntax

In Manifest V3, the content_security_policy key is an object that may have any of these properties, all optional:

Name Type Description
extension_pages String The content security policy used for extension pages. The script-src and worker-src directives may only have these values:
  • 'self'
  • 'none'
  • 'wasm-unsafe-eval'
sandbox String The content security policy used for sandboxed extension pages.

Examples

Valid examples

Note: Valid examples demonstrate the correct use of keys in CSP. However, extensions with 'unsafe-eval', remote script, blob, or remote sources in their CSP are not allowed for Firefox extensions per the add-on policies and due to significant security issues.

Note: Some examples include the object-src directive, which provides backward compatibility for older browser versions. See object-src directive for more details.

Require that all types of content should be packaged with the extension:

  • Manifest V2

    json
    "content_security_policy": "default-src 'self'"

  • Manifest V3

    json
    "content_security_policy": {
  "extension_pages": "default-src 'self'"
}

Allow remote scripts from "https://example.com":

  • Manifest V2

    json
    "content_security_policy": "script-src 'self' https://example.com; object-src 'self'"

  • Manifest V3 does not allow remote URLs in script-src of extension_pages.

Allow remote scripts from any subdomain of "jquery.com":

  • Manifest V2

    json
    "content_security_policy": "script-src 'self' https://*.jquery.com; object-src 'self'"

  • Manifest V3 does not allow remote URLs in script-src of extension_pages.

    json
    "content_security_policy": {
  "extension_pages": "script-src 'self' http://localhost:3000"
}

    However, scripts from localhost can be allowlisted during development for unpacked extensions from Chrome 110 and temporarily loaded extensions from Firefox 147. See Scripts from localhost in Content Security Policy for more information.

Allow eval() and friends:

  • Manifest V2

    json
    "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self';"

  • Manifest V3 does not allow 'unsafe-eval' in script-src.

Allow the inline script: "<script>alert('Hello, world.');</script>":

  • Manifest V2

    json
    "content_security_policy": "script-src 'self' 'sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng='; object-src 'self'"

  • Manifest V3 does not allow CSP hashes in script-src of extension_pages.

Keep the rest of the policy, but also require that images should be packaged with the extension:

  • Manifest V2

    json
    "content_security_policy": "script-src 'self'; object-src 'self'; img-src 'self'"

  • Manifest V3

    json
    "content_security_policy": {
  "extension_pages": "script-src 'self'; img-src 'self'"
}

Enable the use of WebAssembly:

  • Manifest V2

    For backward compatibility, Manifest V2 extensions in Firefox can use WebAssembly without the use of 'wasm-unsafe-eval'. However, this behavior isn't guaranteed. See Firefox bug 1770909. Extensions using WebAssembly are therefore encouraged to declare 'wasm-unsafe-eval' in their CSP. See WebAssembly on the Content Security Policy page for more information.

    json
    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'"

  • Manifest V3

    json
    "content_security_policy": {
  "extension_pages": "script-src 'self' 'wasm-unsafe-eval'"
}

Invalid examples

Policy that omits the "object-src" directive:

json
"content_security_policy": "script-src 'self' https://*.jquery.com;"

However, this is only invalid in browsers that support obsolete plugins. See object-src directive for more details.

Policy that omits the "self" keyword in the "script-src" directive:

json
"content_security_policy": "script-src https://*.jquery.com; object-src 'self'"

Scheme for a remote source is not https:

json
"content_security_policy": "script-src 'self' http://code.jquery.com; object-src 'self'"

Wildcard is used with a generic domain:

json
"content_security_policy": "script-src 'self' https://*.blogspot.com; object-src 'self'"

Source specifies a scheme but no host:

json
"content_security_policy": "script-src 'self' https:; object-src 'self'"

Directive includes the unsupported keyword 'unsafe-inline':

json
"content_security_policy": "script-src 'self' 'unsafe-inline'; object-src 'self'"

Browser compatibility

Chrome
Edge
Firefox
Opera
Safari
Firefox for Android
Safari on iOS
content_security_policy
Chrome – Full support
Chrome 58 (Release date: 2017-04-19)
footnote
footnote Until Chrome 110, the object-src directive was required with a secure source. From Chrome 111, the object-src directive is optional.
Edge – Full support
Edge 79 (Release date: 2020-01-15)
footnote
footnote Until Edge 110, the object-src directive was required with a secure source. From Edge 111, the object-src directive is optional.
Firefox – Full support
Firefox 48 (Release date: 2016-08-02)
footnote
footnote Firefox does not support http://127.0.0.1' or http://localhost as script sources; they must be served over HTTPS.
footnote Until Firefox 105, the object-src directive was required with a secure source. From Firefox 106, the object-src directive is optional.
Opera – Full support
Opera 45 (Release date: 2017-05-10)
footnote
footnote Until Opera 96, the object-src directive was required with a secure source. From Opera 97, the object-src directive is optional.
Safari – Full support
Safari 14 (Release date: 2020-09-16)
footnote
footnote There is no requirement to include the object-src directive.
Firefox for Android – Full support
Firefox for Android 48 (Release date: 2016-08-02)
footnote
footnote Firefox for Android does not support http://127.0.0.1' or http://localhost as script sources; they must be served over HTTPS.
footnote Until Firefox for Android 105, the object-src directive was required with a secure source. From Firefox for Android 106, the object-src directive is optional.
Safari on iOS – Full support
Safari on iOS 15 (Release date: 2021-09-20)
footnote
footnote There is no requirement to include the object-src directive.
extension_pages
Chrome – Full support
Chrome 88 (Release date: 2021-01-19)
footnote
footnote Available for use in Manifest V3 or later.
footnote Until Chrome 110, the object-src directive was required with a secure source. From Chrome 111, the object-src directive is optional.
footnote From Chrome 110, unpacked extensions can relax the CSP to allow scripts from localhost.
Edge – Full support
Edge 88 (Release date: 2021-01-21)
footnote
footnote Available for use in Manifest V3 or later.
footnote Until Edge 110, the object-src directive was required with a secure source. From Edge 111, the object-src directive is optional.
footnote From Edge 110, unpacked extensions can relax the CSP to allow scripts from localhost.
Firefox – Full support
Firefox 72 (Release date: 2020-01-07)
footnote
footnote Until Firefox 105, the object-src directive was required with a secure source. From Firefox 106, the object-src directive is optional.
footnote From Firefox 147, temporarily loaded extensions can relax the CSP to allow scripts from localhost. For more information, see the Scripts from localhost section of the extension-specific Content Security Policy article.
Opera – Full support
Opera 74 (Release date: 2021-02-02)
footnote
footnote Available for use in Manifest V3 or later.
footnote Until Opera 96, the object-src directive was required with a secure source. From Opera 97, the object-src directive is optional.
footnote From Opera 96, unpacked extensions can relax the CSP to allow scripts from localhost.
Safari – Full support
Safari 15.4 (Release date: 2022-03-14)
footnote
footnote Available for use in Manifest V3 or later.
footnote There is no requirement to include the object-src directive.
Firefox for Android – Full support
Firefox for Android 79 (Release date: 2020-07-28)
footnote
footnote Until Firefox for Android 105, the object-src directive was required with a secure source. From Firefox for Android 106, the object-src directive is optional.
footnote From Firefox for Android 147, temporarily loaded extensions can relax the CSP to allow scripts from localhost. For more information, see the Scripts from localhost section of the extension-specific Content Security Policy article.
Safari on iOS – Full support
Safari on iOS 15.4 (Release date: 2022-03-14)
footnote
footnote Available for use in Manifest V3 or later.
footnote There is no requirement to include the object-src directive.
sandbox
Chrome – Full support
Chrome 88 (Release date: 2021-01-19)
footnote Full support
Edge – Full support
Edge 88 (Release date: 2021-01-21)
footnote Full support
Firefox – No support
Firefox
footnote No support
Opera – Full support
Opera 74 (Release date: 2021-02-02)
footnote Full support
Safari – No support
Safari
footnote No support
Firefox for Android – No support
Firefox for Android
footnote No support
Safari on iOS – No support
Safari on iOS
footnote No support

Tip: you can click/tap on a cell for more information.

Full support
No support
See implementation notes.

This page was last modified on by MDN contributors.

Visit Mozilla Corporation’s not-for-profit parent, the Mozilla Foundation.
Portions of this content are ©1998–2026 by individual mozilla.org contributors. Content available under a Creative Commons license.