Remove 'unsafe-eval' from script-src

Why it matters

'unsafe-eval' lets text be run as code through eval() and similar functions, which turns many injection bugs into code execution. Most current libraries no longer need it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: send a copy of your policy without 'unsafe-eval' as Content-Security-Policy-Report-Only; the reports and console show which scripts call eval(), new Function() or string setTimeout().
2. Replace those uses: update libraries, use a template engine's precompiled or CSP build, and pass functions instead of strings to setTimeout and setInterval. If only WebAssembly needs it, use 'wasm-unsafe-eval' instead.
3. Stage 2: remove 'unsafe-eval' from the enforced policy.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Add a Content-Security-Policy
• Enforce the report-only Content-Security-Policy
• Send the Content-Security-Policy as an HTTP header
• Restrict where scripts can load from
• Replace 'unsafe-inline' scripts with nonces or hashes
• Remove wildcard sources from script-src
• Set object-src to 'none'
• Add base-uri to the Content-Security-Policy
• Reduce reliance on inline styles
• Fix the Content-Security-Policy syntax