Chrome extension, XMLHttpRequest Content Security Policy error - google-chrome-extension

Question

I have a Chrome extension that makes a POST request to my website from the extension's background script. I get the following error (shown in Chrome's extension manager):
Refused to connect to 'https://my.website.com/path/' because it violates the following Content Security Policy directive: "default-src 'none'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.
It's honestly not even clear to me if I need to change something in the js code or server-side.
background.js:
var xmlHttp;
function makerequest(){
xmlHttp=new XMLHttpRequest();
xmlHttp.open("POST", "https://my.website.com/path/",true);
xmlHttp.onreadystatechange = got_response;
var formData = new FormData();
xmlHttp.send(formData);
}
function got_response(){
if (xmlHttp.readyState == 4){
alert(xmlHttp.responseText);
}
}
The manifest includes:
"permissions": ["activeTab", "*://my.website.com/*","contextMenus"],
"background": {
"scripts": ["background.js"],
"persistent": false
},
"content_security_policy":"connect-src 'self' https://my.website.com/*",
I have seen that there are other related question/answers. However, they are either trying to access someone else's website (not one I control) or there is an issue with using inline code, which doesn't seem to be the issue here since the code is in background.js (or if it is, please explain!). If you suggest another answer, or vote to close, please please actually checks that the other answer answers THIS question.

Answer 1

You need to remove the trailing asterisk from your CSP string. Asterisks are not interpreted as wildcard characters in the path part of a source identifier in CSP strings. Your current CSP string only allows connections to the literal URL https://my.website.com/*.
Content Security Policy Level 2 specification explicitly says:
The rules for matching source expressions that contain paths are
simpler than they look: paths that end with the '/' character match
all files in a directory and its subdirectories. Paths that do not end
with the '/' character match only one specific file.
Apart from that, the CSP string in the manifest should limit script-src and object-src (either explicitly or using default-src). If it doesn't do that, Chrome displays warnings on the extension details page.
The CSP line in your manifest should therefore look like this:
"content_security_policy":"default-src 'self'; connect-src 'self' https://my.website.com/",