Javascript throwing : Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'self'

Question

I'm newbie in google chrome extention delveopment. I'm trying to develop a simple extension and i keep getting the error above.

my manifest:

{
  "name": "set my favourties",
  "description" : "just another super awesome plugin",
  "version" : "0.1", 
    "background": {
    "page": "backround.html"
  },

   "manifest_version": 2,
    "content_security_policy": "script-src 'self' https://www.google.com; object-src 'self'",

   "browser_action" :{
     "popup" : "popup.html",
     "default_icon" : "icon.gif"
     },

     "permissions" : ["notifications"]
 }

the html code:

<html>
<head>
<script src = "backround.js">

</script>
</head>
<body onload = "loadHandler()">

</body>
</html>

and the js:

  function loadHandler(){
  window.webkitNotifications.createNotification("icon.gif","Plugin Loaded","it was loaded").show();

   }

thanks in advance

Nir

https://developer.chrome.com/extensions/contentSecurityPolicy.html#JSExecution — Rob W, Mar 27 '13 at 11:34
Possible duplicate of [onClick within Chrome Extension not working](http://stackoverflow.com/questions/13591983/onclick-within-chrome-extension-not-working) — Teepeemm, Nov 20 '15 at 20:53
Possible duplicate of [The Chrome extension popup is not working, click events are not handled](http://stackoverflow.com/questions/17601615/the-chrome-extension-popup-is-not-working-click-events-are-not-handled) — Makyen, Nov 29 '16 at 00:58

Quentin · Accepted Answer · 2013-03-27T14:05:29.670

17

~~If this wasn't a Chrome extension, you could add 'unsafe-inline' to the list of acceptable places to load scripts from,~~ but you should avoid using inline event handlers at all.

Replace (in the HTML):

onload = "loadHandler()"

with (in the script):

window.addEventListener('load', loadHandler);

edited Mar 27 '13 at 14:05

answered Mar 27 '13 at 11:37

Quentin

800,325
104
1,079
1,205

3

`unsafe-inline` doesn't work in Chrome extensions. Moving the event listener to a separate script file is the only solution. – Rob W Mar 27 '13 at 14:04
unfortunately yes. Now we have to figure out how to manage so many dynamically attached click events. – Ankit Tanna May 23 '15 at 13:25

score 7 · Answer 2 · answered Mar 28 '13 at 20:41

7

Correct. This is documented here: http://developer.chrome.com/extensions/tut_migration_to_manifest_v2.html#inline_scripts

answered Mar 28 '13 at 20:41

Joe Marini

1,402
11
12

the link is broken – Fernando Torres Feb 13 '21 at 18:49

Javascript throwing : Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'self'

2 Answers2