Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

upgrade-insecure-requests added to default MV3 CSP #23114

Merged
merged 7 commits into from
Jan 4, 2023
Merged

upgrade-insecure-requests added to default MV3 CSP #23114

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f4900a8
upgrade-insecure-requests added to default MV3 CSP
rebloor Dec 21, 2022
dfbb13b
Apply suggestions from review
rebloor Dec 26, 2022
0f59d61
Upgrade insecure network requests to own section
rebloor Dec 26, 2022
7be1019
Merge branch 'main' into CSP-for-MV3
rebloor Jan 3, 2023
c283e75
Apply suggestion from review
rebloor Jan 4, 2023
e630f59
Merge branch 'main' into CSP-for-MV3
rebloor Jan 4, 2023
fc02d70
Added link from release note to upgrade section
rebloor Jan 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Apply suggestions from review 
Co-authored-by: Rob Wu <[email protected]>
  • Loading branch information
@rebloor @Rob--W
rebloor and Rob--W committed Dec 26, 2022
commit dfbb13b38cdfbbfa9777b5a95abb5ca38acf1cb2
4 changes: 2 additions & 2 deletions files/en-us/mozilla/add-ons/webextensions/content_security_policy/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ The default content security policy for extensions using Manifest V2 is:
While for extensions using Manifest V3, the default content security policy is:

```
"script-src 'self'; object-src 'self'; upgrade-insecure-requests;"
"script-src 'self'; upgrade-insecure-requests;"
```

These policies are applied to any extension that has not explicitly set its own content security policy using the [`content_security_policy`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy) manifest.json key. It has the following consequences:
Expand All @@ -61,7 +61,7 @@ These policies are applied to any extension that has not explicitly set its own
- [The extension is not allowed to evaluate strings as JavaScript.](#eval_and_friends)
- [Inline JavaScript is not executed.](#inline_javascript)
- [WebAssembly cannot be used by default.](#webassembly)
- in Manifest V3 extensions, user data requests to `http:` are automatically upgraded to use `https:`. Extensions that need to make `http:` requests can opt-out of this behavior by overriding the default CSP using the [`content_security_policy`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy) manifest.json key.
- Due to presence of {{CSP("upgrade-insecure-requests")}} in the default CSP of Manifest V3 extensions, network requests to `http:` are automatically upgraded to use `https:`. Extensions that need to make `http:` or `ws:` requests can opt-out of this behavior by overriding the default CSP using the [`content_security_policy`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy) manifest.json key with a policy that excludes the `upgrade-insecure-requests` directive.

### Location of script and object resources

Expand Down
2 changes: 1 addition & 1 deletion files/en-us/mozilla/firefox/releases/109/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ This article provides information about the changes in Firefox 109 that will aff

## Changes for add-on developers

- The default [Content Security Policy (CSP)](/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy) for Manifest V3 extensions has been updated to include `upgrade-insecure-requests`. This means that, by default, all user data requests are upgraded to use `https:`. Extensions that need to use `http:` can do so by overriding the default CSP using the [`content_security_policy`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy) manifest.json key ({{bug(1797086)}}).
- The default [Content Security Policy (CSP)](/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy) for Manifest V3 extensions has been updated to include `upgrade-insecure-requests`. This means that, by default, all network requests are upgraded to use `https:`. Extensions that need to use `http:` can do so by overriding the default CSP using the [`content_security_policy`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy) manifest.json key ({{bug(1797086)}}).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please fit the link to #upgrade_insecure_network_requests_in_manifest_v3 in this section.


### Removals

Expand Down