title: How to properly preform ajax inside chrome extension content script on a secure site?
body: <p>I have a chrome extension and in the content-script file I have something like this:</p>
  
  <pre><code>$(document).ready(function() {
  var currentHostname = cleanHostname(window.location.hostname);
  
  $.ajax({
      url:    BASEURL + 'checkSite',
      dataType: 'json',
      method: 'get',
      data: {'hostname': currentHostname},
      success: function(data) {
          data = JSON.parse(data);
          console.log(data);
      }
  });
  });
  </code></pre>
  
  <p>This code works great on non-https site, as chrome allows non-https resources to be allowed on them. However, whenever I go to an https site I get this:</p>
  
  <pre><code>Mixed Content: The page at 'https://www.google.com/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://localhost:8000/checkSite?hostname=google.com'. This request has been blocked; the content must be served over HTTPS.
  </code></pre>
  
  <p>Which makes total sense. I understand this policy. But I think that an extension should get special treatment. How do I work around this? I've considered using background.js to do all the ajax and then do message passing, but I would strongly like to avoid that, but I will if needed.</p>
  
  <p>Does anyone know?</p>