As outlined in the Google Developer program policy (https://developer.chrome.com/webstore/program_policies), incorporating ads into your Chrome extension is permissible under certain conditions:
Ads should be contextually relevant or clearly identified with the associated app or extension. Additionally, users must have the ability to easily remove ads by adjusting settings or uninstalling the app completely. Ads should not mimic system notifications or warnings.
With this directive in mind, I decided to include ads in my extension using Chitika, as AdSense was restricted. However, implementing these ads has been a complex process. It required modifying minified files and ensuring compliance with the Chrome extension manifest's content_security_policy
. Presently, only one company's ads are displaying correctly, while others are blocked due to the following error message:
getads.js:340 Refused to execute inline script due to Content Security Policy restrictions. To allow inline execution, consider using 'unsafe-inline', hashes, or nonces.
I attempted adding the keyword unsafe-inline
, but encountered another issue:
Ignored insecure CSP value "'unsafe-inline'" in directive 'object-src'.
Given these challenges, I am seeking advice on resolving this situation. Since I lack control over how ads are integrated into my software, I face limitations. Any suggestions for overcoming this obstacle? Alternatively, are there other ad platforms suitable for Chrome extensions that can deliver unobtrusive 320x50 ads? Generating income from my popular chrome extension, which receives 8 million page impressions monthly, remains a priority!
Your insights and assistance are greatly appreciated.
Edit: The provided ad code snippet is as follows:
( function() {
if (window.CHITIKA === undefined) { window.CHITIKA = { 'units' : [] }; };
var unit = {"calltype":"async[2]","publisher":"USER_NAME","width":300,"height":250,"sid":"Chitika Default"};
var placement_id = window.CHITIKA.units.length;
window.CHITIKA.units.push(unit);
document.write('<div id="chitikaAdBlock-' + placement_id + '"></div>');
}());
Please remember to include:
<script type="text/javascript" src="../../js/getads.js" async></script>
, accessible via: , after replacing all domain names with the secure https
version.
Edit 2: My content_security_policy
configuration:
"content_security_policy": "script-src 'self' https://www.google-analytics.com https://secure.adnxs.com https://gum.criteo.com https://ib.adnxs.com https://mm.chitika.net https://cdn.chitika.net; object-src 'self'",