Recently, I created a Chrome extension with the main purpose of retrieving specific data from the backend and using it to perform actions on certain domains visited by users.
However, my efforts to have it published have been met with rejection. The reason provided was:
"Your item was found to have requested/fetched one or more external scripts. An example of this is the backend URL in background.js. Please remove all external fetches, including Json type."
(This feedback came as the last of three emails sent to me, each adding a few more words. With only one email received per day, the whole process has become quite frustrating.)
In my background script, I utilize jQuery.ajax. Upon further research, I discovered that by default, it attempts to handle json requests as jsonp requests (although not entirely confirmed). Thus, I set the jsonp property to false in every ajax call within my code. Despite these adjustments, my extension was rejected again today without any additional correspondence, leading me to believe they are specifically targeting the json fetching component.
For reference, here is an example of an ajax call within my code:
$.ajax({
url: backendUrl + '/theendpoint',
data: {
paramName: 'paramValue'
},
dataType: 'json',
cache: false,
jsonp: false
})
While I am under the impression that my approach is permissible, I am aware that interpreting the issue solely based on a snippet of code can be challenging. However, I am confident the problem lies within the ajax calls. Unfortunately, due to limitations, I cannot disclose the content of my manifest file here.
I did include my backend in the permissions section of the manifest. Should I also add it to the content_security_policy, even though it is just used for fetching json and not scripts?
Any assistance would be greatly appreciated.
Edit: On a side note, I am curious if providing a physical address and a link to a privacy policy in my developer account is mandatory. Could this requirement be contributing to the ongoing rejections of my extension? (Interestingly, the most recent rejection did not come with an accompanying email.)