CSP script-src directive

[BarryCarlyon]

script-src is not supported.

Javascript is allowed from the following locations

• Twitch (for the Extension Helper)
• Your Extension
• Google Analytics

And that is it

you cannot modify the script-src CSP for security reasons.

So you should be able to include the firebase script locally and not from their CDN

See also: “Scripts (JavaScript)”

Extensions

Restrictions on scripts

script-src is a Content Security Policy directive that restricts where scripts such as JavaScript can load from. In the case of Extensions, this is set to 'self', https://<extension_id>.ext-twitch.tv, https://extension-files.twitch.tv, and https://www.google-analytics.com. This means that an Extension can only load scripts from itself, https://extension-files.twitch.tv (where the Extension Helper is located), and Google Analytics.

@pierregoutheraud

Should I add that directly into the header of my index.html file?

And a final note: HTML HEAD/meta CSP’s are not supported by twitch at all.