[CSP] Modify existing content security policy not work

[freemedom]

(Please fill out the issue template with your details)

Expected Behavior

Modify existing content security policy (CSP) headers: Remove entirely (possibly unsecure)

Actual Behavior

not work, cannot remove csp headers
still show "Refused to load the script 'https://esm.sh/octokit' because it violates the following Content Security Policy directive"
Seems to have a version before is valid. I remember when I first wrote this script (a month ago) it worked.

Specifications

• Chromium: (114.0.5735.199)
• TM: (v4.20.6185) beta
• OS: (windows10)

Script

(Please give an example of the script if applicable.)

	const { Octokit, App } = await import("https://esm.sh/octokit");

[freemedom]

now i use https://chrome.google.com/webstore/detail/disable-content-security/ieelmcmcagommplceebfedjlakkhpden
but it must manually click and refresh

[derjanb]

If it worked earlier you can switch "Modify existing content security policy (CSP) headers" from "Auto" to "Yes". This will restore the old behavior. However, Tampermonkey can't support CSP relaxing in Chrome when manifest v3 becomes mandatory and also won't support CSP relaxing in Firefox in the near future.

[freemedom]

I switched to "yes", but it still didn't work.

[freemedom]

@derjanb

[derjanb]

Then is never worked with a strict page CSP. You have to set the option to "Remove" (which is working fine here) or better use a bundler like webpack to include all sources in one script, or use @require