Unrecognized Content-Security-Policy directive

Question

I noticed after updating to Google Chrome (21.0.1180.89) I’m getting allot of errors in the developer tab; especially if I visit my own phpMyAdmin site.

There are all the same and are some sort of security against Cross-Site Scripting; are there anything I can do to resolve?

Unrecognized Content-Security-Policy directive 'allow'. 
Unrecognized Content-Security-Policy directive 'options'. 

Answer 1

The allow and options directives are both part of Mozilla's original definition of Content Security Policy. Chrome implements the current W3C standard, which has made several changes from Mozilla's original proposal.

• allow has been replaced with default-src, and sets a default source list for the other CSP directives.
• options has been replaced with 'unsafe-inline' and 'unsafe-eval' (with the single-quotes) sources on either the script-src or style-src directives.

Both of those old-style directive still work in Firefox, using the X-Content-Security-Policy header. If a website delivers a WebKit-prefixed header (X-WebKit-CSP), it should use the current standard.

Note that WebKit has implemented the unprefixed header (Content-Security-Policy) in trunk, and it should be rolling out to stable WebKit-based browsers over the next few months. If you're not already setting the canonical header, now is a good time to start thinking about it. :)