What does “http://*/*”, “https://*/*” and “” mean in the context of Chrome extension’s permissions

“<all_urls>”: matches any URL that starts with a permitted scheme (http:, https:, file:, or ftp:). “http://*/*”: Matches any URL that uses the http: scheme. “https://*/*”: Matches any URL that uses the https: scheme. “*://*/*”: Matches any URL that uses the https: or http: scheme. These permissions are required if your Chrome extension wants to interact … Read more

net::ERR_INSECURE_RESPONSE in Chrome

This happens when you update from Chrome 55 to Chrome 56 (56.0.2924.87). This is an increase in security enforcement. It doesn’t go away by restarting the browser, and it’s not a bug. Mountain View says it’s hoping you don’t ever encounter the message, because Certificate Authorities are required to stop issuing SHA-1 certificates in 2016. … Read more

Chrome blocks FastAPI file download using FileResponse due to using HTTP instead of HTTPS

Option 1 You could use HTTPSRedirectMiddleware to enforce all incoming requests to http being redirected to the secure scheme instead. from fastapi.middleware.httpsredirect import HTTPSRedirectMiddleware app = FastAPI() app.add_middleware(HTTPSRedirectMiddleware) Option 2 In addition to the above, you could use relative URLs instead of using url_for() in your Jinja2 template; for instance: <a href=”/upload_schedule”>Link text</a> In this … Read more

How can I make Chrome allow access to a webcam over http (not https)?

Yes, an admin can override the prompts with a policy. VideoCaptureAllowedUrls Patterns in this list will be matched against the security origin of the requesting URL. If a match is found, access to audio capture devices will be granted without prompt. NOTE: This policy is currently only supported when running in Kiosk mode. On Windows, … Read more

Chrome version 18+: How to allow inline scripting with a Content Security Policy?

For recent versions of Chrome (46+), the previously accepted answer is no longer true. unsafe-inline still has no effect (in the manifest and in meta header tags), but per the documentation, you can use the technique described here to relax the restriction. Hash usage for <script> elements The script-src directive lets developers whitelist a particular … Read more