CSP Blocking External Links in Mobile Webview

[BarryCarlyon]

@jeff-wood-readyup

Yes I agree, our hope is to further expand the twitch extension to provide views with additional event info instead of linking out to our site. However, for our MVP we are opting to link out the website as we also have login/logout functionality for calendar syncing and other features we would like to bring to the extension.

You may get review denied for this feature. And have to add it anyway.

See section 4.6

You may also have issued under 4.6.1 since you are a calendar which may compete with Twitch’s calendar, however this is unlikely.

4.6 is a lot more lax than it used to be with link outs, but non essential link outs should be avoided.

@jeff-wood-readyup

The site does load external libraries, do I also have to whitelist these domains or, as I am assuming from your comment that as long as they are loading over HTTPS with valid SSL they should be fine?

External libraries are not allowed

See section 2.8

Extensions Guidelines & Policies

2.8 All front-end HTML, CSS, and Javascript files used by your Extension must be included in the zip file for your assets. You should not include extraneous files or code not used by your extension.

Also odd that you are trying to use recapctha anyway, since Twitch itself performed a capcthca check when the user logged into Twitch. So you are extra capchating…

You also are using an absolute link “/assets” extension in hosted test and above the code links in a sub folder. So this load request and any like it will fail.