I'm trying to do a porting of an Chrome Extension to use it on Firefox.
The extension just display some informations about the Jira ticket in Github website. In Chrome it looks like:
Everything works well after change few things, except loading images from Atlassian (Jira) website.
Due to some CSP block:
Content Security Policy: The page's settings blocked the loading of a resource at https://myproject.atlassian.net/images/icons/statuses/generic.png ("img-src").
What I don't understand, is that Content-Security-Policy: img-src is supported by both Chrome & Firefox since almost 10 years. So why do they act different?
The content-security-policy header contains for img-src:
img-src
'self'
data:
github.githubassets.com
identicons.github.com
github-cloud.s3.amazonaws.com
secured-user-images.githubusercontent.com/
github-production-user-asset-6210df.s3.amazonaws.com
*.githubusercontent.com;
Full policy:
default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimize…ithubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ github-production-user-asset-6210df.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
So I understand why Firefox refuse to load it. But why Chrome do it without any problem?