google-chromewindows
I've followed the solution here – How to allow Chrome (browser) to load insecure content? – but Chrome continues to complain that "This page is trying to load scripts from unauthenticated sources", requiring me to load the scripts manually, refresh the page and go through this process each time I access the page (or similar pages).
Is there some other way I can disable this aspect of Chrome?
When you visit a secure page with insecure content, a shield icon will appear at the right edge of the omnibar.
Click on the shield icon, and then click Load anyway, and the insecure content will be loaded.
Use a library that offers precompiled templates and you’re all set. You can still use a library that doesn’t offer precompilation, but it will require some work on your part and there are restrictions.
You will need to use sandboxing to isolate any content that you want to do ‘eval’ things to. Sandboxing lifts CSP on the content that you specify.
Sandboxing allows specified pages to be served in a sandboxed, unique origin. These pages are then exempt from their Content Security Policy. Sandboxed pages can use iframes, inline scripting, and eval() (and the last two are the ones being prevented). That'll fix 'unsafe-inline' and 'unsafe-eval'.
You can fetch remote resources via XMLHttpRequest and serve them via blob:, data:, or filesystem: URLs. This should fix the jQuery fetching issue.
To be able to do cross-origin XMLHttpRequests, you'll need to add a permission for the remote URL's host.
XMLHttpRequestFetch the remote URL into the app and serve its contents as a blob: URL.
I don't think you can do any of these. To fix the unsafe-eval and unsafe-inline response headers, only the script owner can fix the code or if it's in public domain, you can fix it. All this is probably a one-time fix.
http://wiki.greasespot.net/UnsafeWindow
http://wiki.greasespot.net/Content_Script_Injection
The hacks however have downsides because they've known to cause security holes atleast the first one, definitely.
Best Answer
Change your Chrome shortcut to this:
Another site showed the command parameter inside the quotes; that is wrong. It must be outside the quotes just like above. I am using it now to play Farmville, which was what was giving me a problem in Chrome.