Disable CSP: switch off Content-Security-Policy in Chrome while you test

Disable CSP is a free, open source Chrome extension for web developers and testers. One click on its toolbar icon removes Content-Security-Policy headers from the pages you load, so blocked scripts, styles or frames can run while you debug; a second click puts them back. A colored icon means CSP is off.

82 users Open source (MIT)
Add to Chrome, free Source code on GitHub
Disable CSP options page explaining what Content Security Policy is and the risks of disabling it
The options page explains what CSP protects against before you turn it off.

Content-Security-Policy (CSP) is a security header that tells the browser which sources a page may load scripts, styles and frames from. It protects users against cross-site scripting (XSS), but it also gets in the way when you inject a debugging script, test a third-party widget or analyze a site.

Use Disable CSP only for testing and development, and switch it off when you are done: while it is on, CSP protection is removed on every site you visit.

What Disable CSP does

One-click toggle

Click the extension icon to disable CSP; click again to enable it. The icon is colored while CSP is disabled and gray when CSP is active.

Removes all three CSP headers

It removes Content-Security-Policy, X-Content-Security-Policy and X-WebKit-CSP from responses for pages and frames, using Chrome's declarativeNetRequest rules.

Remembers its state

The on/off state is saved in Chrome storage, so it survives a browser restart. Check the icon before you browse normally.

English and French

The extension and its options page are available in English and French.

Screenshots

Disable CSP options page explaining what Content Security Policy is and the risks of disabling it
The options page explains what CSP protects against before you turn it off.

How to install

  1. Open Disable CSP on the Chrome Web Store and click Add to Chrome.
  2. Pin the icon from the puzzle-piece menu so you can always see whether CSP is on or off.
  3. Click the icon to disable CSP, then reload the page you are testing.
  4. Click it again when you are done to restore CSP.
Add to Chrome, free

Permissions, explained

  • declarativeNetRequestRemove the CSP headers from responses with a Chrome network rule.
  • declarativeNetRequestWithHostAccessApply that rule to the sites you visit.
  • storageRemember whether CSP is currently disabled.
  • activeTabTemporary access to the current tab, granted only when you click the toolbar icon.
  • <all_urls>Act on every site, because CSP headers can come from any site.

Privacy

Disable CSP does not collect or send any data. Its Chrome Web Store listing declares that it does not collect or use your data, and its code only stores one on/off setting.

Frequently asked questions

Is Disable CSP free?

Yes. It is free on the Chrome Web Store and open source under the MIT license.

What is Content-Security-Policy?

A response header that lists where a page may load scripts, styles, images and frames from. Browsers block anything outside that list, which stops many cross-site scripting (XSS) attacks.

Is it safe to disable CSP?

Only for testing. With CSP removed, pages lose a layer of protection against injected scripts. Turn the extension off as soon as you have finished, and do not leave it on for everyday browsing.

Does it disable CSP on one site only?

No. When it is on, CSP headers are removed for every page and frame you load. That is why the icon changes color: it shows at a glance that CSP is off everywhere.

Does it remove CSP set in a meta tag?

No. It removes CSP sent as HTTP response headers. A policy written in the page as <meta http-equiv="Content-Security-Policy"> is part of the HTML and is not changed.

More from FuryBee

Tabee: Tab Modifier Rules by URL that rename tabs, change their icons, pin, group, mute and protect them, and close duplicates. Feedee Checks your RSS and Atom feeds, notifies you of new posts and lists them in the side panel. ThemesSix lightweight color themes for Chrome, from dark to pastel.