Oleks
29 lines
2.4 KiB
JSON
29 lines
2.4 KiB
JSON
{
|
|
"name": "chrome_csp",
|
|
"description": "Enable/disable Content-Security-Policy for ONE tab. WHEN TO USE: only when injecting code that runs in the page's own context is blocked by the site's CSP \u2014 i.e. MAIN-world userscripts (chrome_userscripts) or page-context script injection on a strict-CSP site. You do NOT need this for chrome_javascript (its CDP/ISOLATED paths already bypass page CSP) or for normal reads/clicks/nav. A (re)load is unavoidable: CSP is fixed at page load, so disabling it always reloads the tab (it can't retroactively un-enforce the current document). Typical flow: chrome_csp{action:'disable',tabId} -> (tab reloads) -> inject -> chrome_csp{action:'enable',tabId} when done. Default method 'dnr' handles header-based CSP (the common case); use method 'cdp' only if the page sets CSP via an in-HTML <meta http-equiv> tag.",
|
|
"parameters": {
|
|
"type": "object",
|
|
"properties": {
|
|
"action": {
|
|
"type": "string",
|
|
"enum": ["disable", "enable", "status"],
|
|
"description": "disable: remove CSP response headers for this tab on subsequent loads; enable: restore CSP for this tab (idempotent); status: report whether CSP is currently disabled for this tab."
|
|
},
|
|
"tabId": {
|
|
"type": "number",
|
|
"description": "Target tab ID. Omit to use the active tab in the current window."
|
|
},
|
|
"reload": {
|
|
"type": "boolean",
|
|
"description": "Reload the tab so the change takes effect (default true, applies to BOTH methods \u2014 CSP is bound at page load and cannot be changed for the already-rendered document). Pass false only if you will navigate this tab yourself right after (the new navigation then carries the change)."
|
|
},
|
|
"method": {
|
|
"type": "string",
|
|
"enum": ["dnr", "cdp", "auto"],
|
|
"description": "Default 'dnr' \u2014 strips CSP *response headers* via a per-tab declarativeNetRequest session rule; no debugger infobar; persists for the browser session; does NOT affect in-HTML <meta http-equiv> CSP. 'cdp' \u2014 CDP Page.setBypassCSP; ALSO removes <meta> CSP (use only when the site sets CSP via a <meta> tag); attaches chrome.debugger (shows the 'being debugged' infobar) and is ephemeral (lost on service-worker restart). 'auto' \u2014 try cdp, fall back to dnr if the debugger can't attach (e.g. chrome:// page). Both methods reload by default. The response's `method` field reports which was actually used."
|
|
}
|
|
},
|
|
"required": ["action"]
|
|
}
|
|
}
|