Unable to redirect JavaScript URL via browser extension from certain website due to CSP
17:09 19 Mar 2025

I am unable to redirect JavaScript URLs via browser extension from a certain domain due to its CSP put in place from the html file which requests the target JavaScript URL. I have also tried using modifyHeader rule action types to remove X-Frame-Options and Content-Security-Policy headers but it's of no use. I am targeting 2 websites and my redirects do work for one of them which I assume to not use CSP.

My manifest.json file. targetA is the website which I'm able to redirect a specific JavaScript URL and targetB is the one I'm unable to:

{
    "manifest_version": 3,
    "name": "non-declarative-net-request",
    "version": "1.0.0",
    "permissions": [
        "activeTab",
        "declarativeNetRequest",
        "declarativeNetRequestWithHostAccess",
        "nativeMessaging",
        "webRequest",
        "webRequestBlocking"
    ],
    "host_permissions": [
        ""
    ],
    "background": {
        "scripts": [
            "background.js"
        ]
    },
    "content_scripts": [
        {
            "matches": [
                "*://*.targetA.com/*",
                "*://targetB.org/*"
            ],
            "js": [
                "src/main/js/index.js"
            ]
        }
    ],
    "declarative_net_request": {
        "rule_resources": [
            {
                "id": "ruleset_1",
                "enabled": true,
                "path": "rules.json"
            }
        ]
    }
}

My rules.json file:

[
    {
        "id": 1,
        "priority": 1,
        "action": {
            "type": "modifyHeaders",
            "responseHeaders": [
                {
                    "header": "X-Frame-Options",
                    "operation": "remove"
                },
                {
                    "header": "Content-Security-Policy",
                    "operation": "remove"
                }
            ]
        },
        "condition": {
            "urlFilter": "*://targetB.org/*",
            "resourceTypes": [
                "main_frame",
                "sub_frame",
                "object",
                "script",
                "xmlhttprequest",
                "csp_report",
                "other"
            ]
        }
    },
    {
        "id": 2,
        "priority": 1,
        "action": {
            "type": "redirect",
            "redirect": {
            "urlFilter": "http://127.0.0.1:3600/targetA/target.js",
            }
        },
        "condition": {
            "urlFilter": "https://www.targetA.com/target.js",
            "resourceTypes": [
                "script"
            ]
        }
    },
    {
        "id": 3,
        "priority": 1,
        "action": {
            "type": "redirect",
            "redirect": {
                "url": "http://127.0.0.1:3600/targetB/target.js"
            }
        },
        "condition": {
            "urlFilter": "https://targetB.org/target.js",
            "resourceTypes": [
                "script"
            ]
        }
    }
]

I also tried to test different values for the rules' priority's but that didn't work either.

javascript browser content-security-policy