# Content Security Policy and sources **URL:** \ **Category:** Extensions\ **Created:** [January 27, 2019, 5:00pm UTC](https://discuss.dev.twitch.com/t/content-security-policy-and-sources/19725 "2019-01-27T17:00:01Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![HorrorOfCthulhu](https://avatars.discourse-cdn.com/v4/letter/h/c77e96/32.png) [@HorrorOfCthulhu](https://discuss.dev.twitch.com/u/HorrorOfCthulhu)\ **Post date:** [January 27, 2019, 5:00pm UTC](https://discuss.dev.twitch.com/t/content-security-policy-and-sources/19725/1 "2019-01-27T17:00:01Z")
Hi! I’m writing my first extension for twitch and it’s almost ready, local tests on DevRig are fine, but when the host gives two error: > Content Security Policy: the page settings have blocked the download of the resource inline (script-src) > > Failed postMessage on DOMWindow: the specified source goal (https://—.ext-twitch.tv) does not match the source window of the recipient ([https://supervisor.ext-twitch.tv](https://supervisor.ext-twitch.tv)). All asset files are stored on Twitch CDN, inline tags do not exist. I’m not very experienced in this, could you tell me what to do? ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [January 27, 2019, 8:54pm UTC](https://discuss.dev.twitch.com/t/content-security-policy-and-sources/19725/2 "2019-01-27T20:54:50Z")
This are probably safe to ignore. Is your extension working? ---
**Author:** ![HorrorOfCthulhu](https://avatars.discourse-cdn.com/v4/letter/h/c77e96/32.png) [@HorrorOfCthulhu](https://discuss.dev.twitch.com/u/HorrorOfCthulhu)\ **Post date:** [January 28, 2019, 4:27pm UTC](https://discuss.dev.twitch.com/t/content-security-policy-and-sources/19725/3 "2019-01-28T16:27:26Z")
Yeah, thanks, I fix it, I just needed to read more theory. Waiting for approval, I hope 😌