Search code examples
javascriptangularevalcontent-security-policy

block eval() in CSP header Angular 8 project

Can I block the eval function in CSP-Header for a Angular project (when I don't use it directly) or a there any side effects which would lead to errors when the project is deployed?

Thanks

Solution

  • If you set the default-src or script-src directives eval will be blocked unless you allow it with 'unsafe-eval'. If eval, setTimeout, setInterval or new Function is being called in any script it will be blocked. If you are concerned that something may break run Content-Security-Policy-Report-Only for a while and check the reports that are sent.