REST API Error: Refused to connect to … because it violates the following Content Security Policy directive:

Question

I am trying to update my status on twitter using the REST API to "Update Status".

I am posting it on Twitter's own site, this is what I'm posting:

$.post("https://api.twitter.com/1.1/statuses/update.json?status=Hello")

However I get the error

Refused to connect to ' https://api.twitter.com/1.1/statuses/update.json?status=Hello ' because it violates the following Content Security Policy directive: "connect-src graph.facebook.com pay.twitter.com analytics.twitter.com upload.twitter.com 'self'".

Can anyone help? I'm just finding the twitter tutorial a bit confusing; all I want to accomplish is using an api that can easily send tweets. Do I need to do this in a chrome extension?

Answer 1

You need to add api.twitter.com to your CSP:

<meta http-equiv="Content-Security-Policy"
    content="connect-src graph.facebook.com
             pay.twitter.com analytics.twitter.com
             upload.twitter.com api.twitter.com 'self'">

Not sure exactly what your current content security policy looks like, but the correct domain ( api.twitter.com ) needs to be added to it. This would be in your index.html , by the way.

If you want to see the docs, I'd check out the ones from MDN "Using Content Security Policy" .

Edit

You can change the CSP in the manifest.json ( read the docs ):

{
  ...,
  "content_security_policy": "[POLICY STRING GOES HERE]"
  ...
}