CSP Issues - At my wits end!

Extensions
1

SO I’ve just moved to the Hosted Test with my extension, but when it loads in the Twitch interface it doesn’t seem to be respecting all the allowed URLs set in the developer config.

Content-Security-Policy: The page’s settings blocked the loading of a resource 
(connect-src) at https://video.bsky.app/watch/did%3Aplc%3A37x2qvt3z5iwuyzusvnvlepi/bafkreib76g6e7zgizticof4i7nkqz5rx64ymkqigimbswuzl7hqjhjntfu/playlist.m3u8 
because it violates the following directive: 
“connect-src 'self' https://lzgcylllyglx755qp8ay2q9a82orlh.ext-twitch.tv https://api.twitch.tv 
wss://pubsub-edge.twitch.tv https://public.api.bsky.app https://*.google-analytics.com 
https://stats.g.doubleclick.net https://www.googletagmanager.com”

But in the extension capabilities, Allowlist for URL Fetching Domains has:
https://public.api.bsky.app, https://video.bsky.app I have also added it the Allowlist for Media Domains

As can be seen in the error, the first url is in the allowed list (added this one earlier during development), but the second one is not added. Additional if I remove all the urls, or make it a wildcard nothing changes, the list in the error message stays the same.

2

Caching.

It’s a weird caching hiccup.

Theres no sensible repro case for it (never caused it myself)

your browser is seemingly hanging on to a dirty csp.

It could be fixed with a cache clear or reuploading files for hosted test

3

So I’ve tried

  1. Disabled cache in Firefox Dev tools
  2. Separate browser window (Chrome instead of Firefox)
  3. An entirely different computer (on a different Twitch account)
  4. Uploaded a new file zip

And all still exhibit the same issue, I can only think it’s something on the Twitch side that hasn’t updated properly or is cached

4

So I’ve also just tried

  1. Creating a new version in the same extension
  2. Creating a brand new extension, adding the appropriate entries in the developer console from the get go

On the new extension, the fetching domains had both: https://public.api.bsky.app,https://video.bsky.app

the api one seems to work fine, as the data loads from the API but the video one doesn’t work

5

And just like that it now seems to have fixed itself, don’t you just love bugs like that!

6

caching or dns, then it’s always dns…

But yeah… a weird one