Removing security headers like Content-Security-Policy is forbidden by the addon... | Hacker News

Hacker News new | past | comments | ask | show | jobs | submit

login

evilpie 29 days ago | parent | context | favorite | on: Hardening the Firefox Front End with Content Secur...

Removing security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy.

https://extensionworkshop.com/documentation/publish/add-on-p...

gear54rus 29 days ago [–]

I don't think this is being enforced in practice, thankfully.

davidmurdoch 29 days ago | [–]

It is. It happened to us a few weeks ago.

gear54rus 29 days ago | | [–]

That's crazy. Did it happen to a public extension or an unlisted one?

davidmurdoch 29 days ago | | [–]

Public, with about half a million installations.

I think it was noticed only because this version had a major bug that broke a bunch of websites.

Consider applying for YC's Summer 2025 batch! Applications are open till May 13
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact