**My recommendation**

The value in the manifest and the value in the header are not the same thing, so I don't think we need to keep these in sync. Instead, my thought was it may be best to keep the more [restrictive default](https://developer.chrome.com/extensions/contentSecurityPolicy#restrictions) CSP for the manifest entry:

```text
script-src 'self'; object-src 'self'
```

We may want to reconsider the value we are injecting into the header. It may be better to use a more restrictive value that also works. My suggestion is to perhaps consider:

```javascript
details.responseHeaders[i].value = "default-src 'none'; style-src 'self' 'unsafe-inline';";
```

This is more restrictive and still removes the error.

Perhaps, @mojavelinux had reasons that he preferred to use the same value as Atom and in that case we can for the headers, but not for the manifest.

**Keeping the values in sync**

We cannot use the same CSP in the manifest that Atom does. Specifically the following CSP in the manifest:

```text
default-src *; script-src 'self'; style-src 'self' 'unsafe-inline';
```

produces the following error:

> Could not load extension from <path>. Invalid value for 'content_security_policy': Both 'script-src' and 'object-src' directives must be specified (either explicitly, or implicitly via 'default-src'), and both must whitelist only secure resources. You may include any of the following sources: "'self'", "'unsafe-eval'", "http://127.0.0.1", "http://localhost", or any "https://" or "chrome-extension://" origin. For more information, see http://developer.chrome.com/extensions/contentSecurityPolicy.html

A compromise (not recommended unless we have good reason) might be to use the following CSP which is less restrictive than the manifest default but more lenient than the header:

```text
default-src 'self'; style-src 'self' 'unsafe-inline';
```

**Actual Issue**

After initial hesitation, I decided to try and track down the actual reason the CSP was being triggered and 
I believe this may be a Chrome issue and not related to the plugin at all. If I disable all my extensions and access https://raw.githubusercontent.com/asciidoctor/asciidoctor/master/README.adoc I still get the error. In fact, if I access a page with the following HTTP response I also get the error:

```html
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
content-Security-Policy: style-src 'none'
Last-Modified: Thu, 29 May 2014 21:37:42 GMT
Content-Length: 2
Date: Thu, 29 May 2014 21:54:46 GMT

a
```

Adding `Content-Type: text/plain` or `Content-Type: text/html` the error is still present. The nearest [issue](https://code.google.com/p/chromium/issues/detail?id=13296) I could find is fixed but perhaps its fix is causing our issue (i.e. maybe default styles by the browser are being blocked).