Inconsistency: content_security_policy syntax

[carlosjeurissen]

Classic syntax

There are two syntaxes for content_security_policy. First one is the classic syntax. Defined as a string under content_security_policy for extension pages. and under sandbox.content_security_policy for sandboxes.

Modern object syntax

The second and newer syntax uses an object notation. The object notation is as follows:

{
  "content_security_policy": {
      "extension_pages": "CSP for extension pages, equivalent to the old string notation",
      "sandbox": "CSP for sandbox, previously under sandbox.content_security_policy",
      "content_scripts": "CSP specifically for content scripts"
  }
}

Support

Currently, MV3 in browsers require the newer object notation. While MV2 requires the classic string syntax.

Firefox has proposed to support using the object notation in MV2 as well. See Firefox announcement.

A proposal to keep supporting the classic syntax in mv3 can be found here:
Crbug 1158786. Tho as mentioned in the issue report this might not be a welcome change.

Action items

• Document in what browsers what syntaxes are supported under what manifest version
• Consider supporting the object syntax in MV2 in other browsers than Firefox
• Consider supporting the string syntax as alias for content_security_policy.extension_pages

[carlosjeurissen]

Conclusion:
Firefox supports the object syntax in MV2 nowadays.
There is no intend to support the object syntax in MV2 for other browsers. Also there is no need to support the string syntax for CSP as the manifest version clearly changes.