What is the "CSP Unblock" add-on and how can I use it?

This extension is meant to ease inline and remote JavaScript execution on web pages that forbid them by applying a Content-Security-Policy header. Also, by disabling CPS-related headers, the limitation on the cross-origin resource access is lifted. Make sure to enable the extension from the toolbar area, then refresh the page for the changes to take effect.

What's new in this version?

Please check the Logs section.

What CPS-related headers are supported?

At this moment, the extension supports four headers that control the CSP of the web pages:

• Content-Security-Policy
• Content-Security-Policy-Report-Only
• X-Webkit-CSP
• X-Content-Security-Policy

What is the "Content Security Policy" header and why do websites use this header?

Content Security Policy (CSP) is an additional layer of security that aims in the detection and mitigation of specific sorts of threats, such as Cross-Site Scripting (XSS) and data injection.

CSP was created with complete backward compatibility in mind. Browsers that don't support it can still communicate with servers that do, and vice versa: browsers that don't support CSP disregard it and continue to operate normally, using the conventional same-origin policy for web content. Browsers apply the conventional same-origin policy if the site does not supply the CSP header.

What is the "Content-Security-Policy-Report-Only" header?

The HTTP Content-Security-Policy-Report-Only response header allows web developers to experiment with policies by monitoring (but not enforcing) their effects. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.

What is the "X-Webkit-CSP" header?

This is a deprecated HTTP header and it is being replaced by the "Content Security Policy" header.