title: Why won't Chrome load extension with Content Security Policy that allows localhost?
body: <p>I'm working on a Chrome extension and wanted to load scripts from <code>localhost</code> for development. So I updated the manifest file to have the following line:</p>
  
  <pre><code>"content_security_policy": "script-src 'self' http://localhost; object-src 'self'",
  </code></pre>
  
  <p>According to the doc on <a href="http://developer.chrome.com/extensions/contentSecurityPolicy.html#relaxing-remote-script" rel="nofollow">Content Security Policy</a>, it's perfectly fine to use <code>localhost</code> or <code>127.0.0.1</code> without <code>https</code>.</p>
  
  <p>However, I get the following (taunting) error message when I try to load the extension from <code>chrome://chrome/extensions/</code>:</p>
  
  <blockquote>
    <p>Could not load extension from '/Users/Tim/Desktop/temp/test'. Invalid value for 'content_security_policy': Both 'script-src' and 'object-src' directives must be specified (either explicitly, or implicitly via 'default-src'), and both must whitelist only secure resources. You may include any of the following sources: "'self'", "'unsafe-eval'", "http://127.0.0.1", "http://localhost", or any "https://" or "chrome-extension://" origin. For more information, see <a href="http://developer.chrome.com/extensions/contentSecurityPolicy.html" rel="nofollow">http://developer.chrome.com/extensions/contentSecurityPolicy.html</a></p>
  </blockquote>
  
  <p>To confirm the problem, you can create an empty directory with the following <code>manifest.json</code> file:</p>
  
  <pre><code>{
    "name": "Example extension",
    "description": "Trying to demonstrate a bug in Chrome",
    "version": "0.1",
    "homepage_url": "http://example.com",
    "content_security_policy": "script-src 'self' http://localhost; object-src 'self'",
  
    "manifest_version": 2
  }
  </code></pre>
  
  <p>and load the directory as an unpacked extension. You should be getting the error. If you remove <code>http://localhost</code> or change it to <code>https://localhost</code>, it will load fine.</p>
  
  <p>Am I missing something?</p>
  
  <p>(NB: I'm using Chrome 22.0.1229.79)</p>
  
  <p>Thanks!</p>