{"action":"created","issue":{"url":"https://api.github.com/repos/google/google-api-javascript-client/issues/64","labels_url":"https://api.github.com/repos/google/google-api-javascript-client/issues/64/labels{/name}","comments_url":"https://api.github.com/repos/google/google-api-javascript-client/issues/64/comments","events_url":"https://api.github.com/repos/google/google-api-javascript-client/issues/64/events","html_url":"https://github.com/google/google-api-javascript-client/issues/64","id":53587123,"number":64,"title":"Gapi incompatible with chrome extensions","user":{"login":"wonderfly","id":6642209,"avatar_url":"https://avatars.githubusercontent.com/u/6642209?v=3","gravatar_id":"","url":"https://api.github.com/users/wonderfly","html_url":"https://github.com/wonderfly","followers_url":"https://api.github.com/users/wonderfly/followers","following_url":"https://api.github.com/users/wonderfly/following{/other_user}","gists_url":"https://api.github.com/users/wonderfly/gists{/gist_id}","starred_url":"https://api.github.com/users/wonderfly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wonderfly/subscriptions","organizations_url":"https://api.github.com/users/wonderfly/orgs","repos_url":"https://api.github.com/users/wonderfly/repos","events_url":"https://api.github.com/users/wonderfly/events{/privacy}","received_events_url":"https://api.github.com/users/wonderfly/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/google/google-api-javascript-client/labels/21+%20stars","name":"21+ stars","color":"FFFFFF"},{"url":"https://api.github.com/repos/google/google-api-javascript-client/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/google/google-api-javascript-client/labels/imported","name":"imported","color":"FFFFFF"},{"url":"https://api.github.com/repos/google/google-api-javascript-client/labels/Priority-Medium","name":"Priority-Medium","color":"FFFFFF"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-01-07T01:35:43Z","updated_at":"2016-01-10T20:49:18Z","closed_at":null,"body":"_From [willscott](https://code.google.com/u/willscott/) on November 28, 2012 16:34:46_\n\nAttempting to use GAPI within a chrome extension can be done in two ways:\r\n   a. Modify the extension Content Security Policy + permitted domains for all of google + googleapis.com\r\n   b. Use an unprivileged (sandboxed) frame for interaction with google.\r\n\r\nIf option a is chosen, the user must agree that your extension can see and mediate all of their communications with google, which is not ideal, and a scary requirement to impose.\r\n\r\nOption b doesn't work, (the bug / feature request) because sandboxed frames are given a unique 'null' origin, causing the messages posted from shindig to fail. Gapi should detect it is loaded in this context and post messages to the wildcard origin '*', rather than the null origin.\r\n\r\nIdeally the google api (gapi.client.load and friends) should work from a sandboxed iframe in a chrome extension.\r\n\r\nInstead you see either:\r\n\"Uncaught Error: an attempt was made to break through the security policy of the user agent.\"\r\ndue to an attempt to access 'window.document.cookie'\r\nor\r\n\"Unable to post message to chrome-extension://<extension id>. Recipient has origin null.\"\r\nat core:rpc:shindig.random:shindig.sha1.js:1923\r\n(in gadgets.rpctx within the feature=rpc section of that file)\n\n_Original issue: http://code.google.com/p/google-api-javascript-client/issues/detail?id=64_"},"comment":{"url":"https://api.github.com/repos/google/google-api-javascript-client/issues/comments/170392857","html_url":"https://github.com/google/google-api-javascript-client/issues/64#issuecomment-170392857","issue_url":"https://api.github.com/repos/google/google-api-javascript-client/issues/64","id":170392857,"user":{"login":"hjuinj","id":5151132,"avatar_url":"https://avatars.githubusercontent.com/u/5151132?v=3","gravatar_id":"","url":"https://api.github.com/users/hjuinj","html_url":"https://github.com/hjuinj","followers_url":"https://api.github.com/users/hjuinj/followers","following_url":"https://api.github.com/users/hjuinj/following{/other_user}","gists_url":"https://api.github.com/users/hjuinj/gists{/gist_id}","starred_url":"https://api.github.com/users/hjuinj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hjuinj/subscriptions","organizations_url":"https://api.github.com/users/hjuinj/orgs","repos_url":"https://api.github.com/users/hjuinj/repos","events_url":"https://api.github.com/users/hjuinj/events{/privacy}","received_events_url":"https://api.github.com/users/hjuinj/received_events","type":"User","site_admin":false},"created_at":"2016-01-10T20:49:18Z","updated_at":"2016-01-10T20:49:18Z","body":"May I ask which additional domains I would need to add to the  Content Security Policy? My extension is using the youtube analytics gapi to return the most relevant video by keyword search. And then I use the youtube iframe api to play this video in my popup.html.\r\n\r\nI tried adding \"https://apis.google.com/\" to the CSP but it did not seem to work."}}