Hacker News new | ask | show | jobs
by fiddlerwoaroof 1849 days ago
Yeah, CSP breaking bookmarklets and extensions is arguably not to spec[1]. Firefox finally partially fixed their non-conforming implementation recently[2], but I think Chromium still has an open bug here.

[1]: Policy enforced on a resource SHOULD NOT interfere with the operation of user-agent features like addons, extensions, or bookmarklets. These kinds of features generally advance the user’s priority over page authors, as espoused in [HTML-DESIGN].

https://www.w3.org/TR/CSP3/#extensions

[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1478037