iframe 推特移动网站答案

【问题标题】：iframe twitter mobile websiteiframe 推特移动网站
【发布时间】：2017-09-27 23:13:46
【问题描述】：

我真的需要将 twitter.com 移动网站 iframe 变成一个歌剧扩展，想知道是否有人知道以下错误是什么意思

sidebar.html:8 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' https://mobile.twitter.com/". Either the 'unsafe-inline' keyword, a hash ('sha256-hM+vuSKyk8KinSQRAwVUgib4/cFYwMvRenQfLzc9VzE='), or a nonce ('nonce-...') is required to enable inline execution.

代码边栏.html

    <meta http-equiv="Content-Security-Policy" content="default-src 'self' data: https://mobile.twitter.com/ 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; media-src *; img-src 'self' data: content:;">
    <script type="text/javascript">
    document.domain = 'twitter.com';
    </script>
    <style>
      html,
      body,
      iframe {
        background-color: white;
        border: none;
        height: 100%;
        margin: 0;
        overflow: hidden;
        padding: 0;
        width: 100%;
         z-index: 99999999;
      }
    </style>
  </head>
  <body>
  <iframe frame-src="https://mobile.twitter.com" ></iframe>
    <script src="sidebar.js" defer></script>
    </body>
</html>

background.js

chrome.webRequest.onHeadersReceived.addListener(
  function (details) {
    return {
      responseHeaders: details.responseHeaders.filter(function(header) {
        //return (header.name.toLowerCase() !== 'x-frame-options');
      })
    };
  }, {
    urls: ["http://*.twitter.com","https://mobile.twitter.com/"]
  }, ["blocking", "responseHeaders"]);

sidebar.js

opr.sidebarAction.onFocus.addListener(

)

manifest.json

{
   "background": {
      "scripts": [ "background.js"]
   },
   "description": "TweetTab allows you to quickly and easily access Twitter when you need/want to post.",
   "developer": {
      "name": "russellharrower"
   },
   "icons": {
      "128": "icons/128.png",
      "19": "icons/19.png",
      "38": "icons/38.png",
      "48": "icons/48.png"
   },
    "manifest_version": 2,
   "name": "TwitTab",
   "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'",
   "permissions": [ "webRequest", "webRequestBlocking", "https://*.twitter.com/", "*" ],
   "sidebar_action": {
      "default_icon": "icons/38.png",
      "default_panel": "sidebar.html",
      "default_title" : "TweetTab",
        // Required
      "default_panel": "sidebar.html"
    },
   "web_accessible_resources":["sidebar.html"],
   "version": "1.0.1"
}

【问题讨论】：

标签： javascript iframe google-chrome-extension opera

【解决方案1】：

关于您的问题的两个潜在来源

sidebar.html 中有内联 Javascript

将此代码重构为单独的 Javascript 文件或更改您的内容安全政策。

<script type="text/javascript">
    document.domain = 'twitter.com';
</script>

Twitter 的 HTTP 响应将 x-frame-options 标头设置为 SAME ORIGIN。但您似乎已经尝试过考虑这一点。

看看this question的答案。

【讨论】：