ProperHeaderHow to remove a Content-Security-Policy in Chrome for testing
A strict Content-Security-Policy is great for users and frustrating when you're debugging: injected scripts, overridden files and some dev tools get blocked. For testing, you can remove or rewrite the header before the page sees it.
Remove CSP with ProperHeader
Changing response headers is a Pro feature.
- Open Full editor and click Strip CSP under Quick start. It adds a response-header rule: Remove
Content-Security-Policy. - Under Filters → Only on URLs matching, add the site you're testing, for example
https://staging.example.com/*. - Reload the page. Scripts and overrides the policy was blocking now load.
If the site also sends Content-Security-Policy-Report-Only, that only reports and doesn't block, so you can leave it.
Rewrite instead of removing
To test a specific policy change, for example adding a script source before you deploy it, use Set instead of Remove and paste the whole new policy as the value. That lets you test a stricter or looser policy without touching the server.
Just for file overrides?
If you only need CSP out of the way so a file override loads, use the override's own Remove CSP on field. It strips CSP only on the pages you list, and only while that override is on.
Limits
- A CSP set in a
<meta http-equiv="Content-Security-Policy">tag is part of the HTML, not a header, so removing headers doesn't affect it. Override the HTML page to change it. - Responses from a service worker's cache aren't changed.
Questions
How do I disable Content-Security-Policy in Chrome?
Chrome has no switch for it, but a header extension can remove the Content-Security-Policy response header on the sites you choose. In ProperHeader, use the Strip CSP recipe and limit it with a URL filter.
Is removing CSP dangerous?
It lowers a page's protection against injected scripts, so only do it on sites you're testing, and pause the rule when you're done.
Why is the CSP still applied after removing the header?
The page may set its policy in a meta tag inside the HTML, which isn't a header. Override the HTML to change it.