Content-Security-Policy can block pages about side-view

[nt1m]

One way to solve the CSP problem is just to drop the "home" and "Desktop" buttons completely and use sidebar.setPanel({ panel: 'urltoload' }); directly. The 'home' and 'desktop' buttons could possibly move to a browserAction.

[ianb]

@nt1m Yes, initially that's how this was implemented, but @johngruen really wanted to add a little UI in the sidebar, and there's no other good way to do that besides the iframe (that I've come up with). @clouserw pointed out that only a really small number of sites use CSP currently, and even those that do don't necessary use frame-ancestors (X-Frame-Options is the more popular way, and we are able to fix that).

I'm going to close this and create a new issue for simply warning the user when this case is encountered.

[ianb]

I should never have tested on testpilot.firefox.com! My tests seem to work on https://github.com, which has the offending headers. This isn't all that surprising, as testpilot.firefox.com is blacklisted in some cases.

[pdehaan]

Possibly another site to test with, https://www.cnn.com/

[nt1m]

If you're interested, a possible approach would be exposing <iframe mozbrowser> to Mozilla signed WebExtensions. <iframe mozbrowser> is not affected by CSP, and as a plus it has methods like canGoBack/goBack/etc...

The original plan was to expose it to all WebExtensions: https://bugzilla.mozilla.org/show_bug.cgi?id=1318532
but that's currently blocked by standardization issues. Exposing it to mozilla signed webextensions should be fine though.