# CSP Issues - At my wits end! **URL:** \ **Category:** Extensions\ **Created:** [May 11, 2025, 4:49pm UTC](https://discuss.dev.twitch.com/t/csp-issues-at-my-wits-end/63550 "2025-05-11T16:49:00Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![SkewHusky](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/skewhusky/32/30718_2.png) [@SkewHusky](https://discuss.dev.twitch.com/u/SkewHusky)\ **Post date:** [May 11, 2025, 4:49pm UTC](https://discuss.dev.twitch.com/t/csp-issues-at-my-wits-end/63550/1 "2025-05-11T16:49:00Z")
SO I’ve just moved to the Hosted Test with my extension, but when it loads in the Twitch interface it doesn’t seem to be respecting all the allowed URLs set in the developer config. ```auto Content-Security-Policy: The page’s settings blocked the loading of a resource (connect-src) at https://video.bsky.app/watch/did%3Aplc%3A37x2qvt3z5iwuyzusvnvlepi/bafkreib76g6e7zgizticof4i7nkqz5rx64ymkqigimbswuzl7hqjhjntfu/playlist.m3u8 because it violates the following directive: “connect-src 'self' https://lzgcylllyglx755qp8ay2q9a82orlh.ext-twitch.tv https://api.twitch.tv wss://pubsub-edge.twitch.tv https://public.api.bsky.app https://*.google-analytics.com https://stats.g.doubleclick.net https://www.googletagmanager.com” ``` But in the extension capabilities, `Allowlist for URL Fetching Domains` has: `https://public.api.bsky.app, https://video.bsky.app` I have also added it the `Allowlist for Media Domains` As can be seen in the error, the first url is in the allowed list (added this one earlier during development), but the second one is not added. Additional if I remove all the urls, or make it a wildcard nothing changes, the list in the error message stays the same. ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [May 11, 2025, 8:16pm UTC](https://discuss.dev.twitch.com/t/csp-issues-at-my-wits-end/63550/2 "2025-05-11T20:16:53Z")
Caching. It’s a weird caching hiccup. Theres no sensible repro case for it (never caused it myself) your browser is seemingly hanging on to a dirty csp. It could be fixed with a cache clear or _reuploading_ files for hosted test ---
**Author:** ![SkewHusky](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/skewhusky/32/30718_2.png) [@SkewHusky](https://discuss.dev.twitch.com/u/SkewHusky)\ **Post date:** [May 11, 2025, 9:16pm UTC](https://discuss.dev.twitch.com/t/csp-issues-at-my-wits-end/63550/3 "2025-05-11T21:16:37Z")
So I’ve tried 1. Disabled cache in Firefox Dev tools 2. Separate browser window (Chrome instead of Firefox) 3. An entirely different computer (on a different Twitch account) 4. Uploaded a new file zip And all still exhibit the same issue, I can only think it’s something on the Twitch side that hasn’t updated properly or is cached ---
**Author:** ![SkewHusky](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/skewhusky/32/30718_2.png) [@SkewHusky](https://discuss.dev.twitch.com/u/SkewHusky)\ **Post date:** [May 11, 2025, 9:45pm UTC](https://discuss.dev.twitch.com/t/csp-issues-at-my-wits-end/63550/4 "2025-05-11T21:45:48Z")
So I’ve also just tried 1. Creating a new version in the same extension 2. Creating a brand new extension, adding the appropriate entries in the developer console from the get go On the new extension, the fetching domains had both: [https://public.api.bsky.app](https://public.api.bsky.app),[https://video.bsky.app](https://video.bsky.app) the api one seems to work fine, as the data loads from the API but the video one doesn’t work ---
**Author:** ![SkewHusky](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/skewhusky/32/30718_2.png) [@SkewHusky](https://discuss.dev.twitch.com/u/SkewHusky)\ **Post date:** [May 12, 2025, 12:18am UTC](https://discuss.dev.twitch.com/t/csp-issues-at-my-wits-end/63550/5 "2025-05-12T00:18:16Z")
And just like that it now seems to have fixed itself, don’t you just love bugs like that! ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [May 12, 2025, 9:03am UTC](https://discuss.dev.twitch.com/t/csp-issues-at-my-wits-end/63550/6 "2025-05-12T09:03:17Z")
caching or dns, then it’s always dns… But yeah… a weird one