Angular 5 & CSP - Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script

Question

I'm currently experimenting with introducing a Content Security Policy to my application that is built using Angular 5. I'm currently implementing the CSP using a meta tag in my index.html although I will change this in the future. I have inserted the following into my app

<meta http-equiv="Content-Security-Policy" content="script-src 'self'; img-src 'self' data:;media-src 'self'; object-src 'self' data: 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline';">

This pretty much covers my needs however when I deploy to a testing server the Browser Console gives me the following message:

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

Okay, so I need to add the 'unsafe-eval' to the script-src directive. That's not really a problem but it does seem to make me worried remembering that eval() is evil!

For Angular 5 applications that wish to use a CSP is it necessary to have to include 'unsafe-eval' to the script-src directive? Is there a way I can retain the security feature preventing the use of eval() ? Is it necessary to include this as Angular uses eval() . I am assuming that the content of the Content-Security-Policy meta tag is correct although I am sure it may not be the case.

I read this Issue on the angular github https://github.com/angular/angular/issues/19142 but I am unsure if this issue is relevant to me as I am not using SystemJS but webpack in my application?

Many thanks in advice for help, answers and suggestions.

Answer 1

I faced the same issue, and I noticed that running in --prod mode doesn't give errors (I'm using Angular 8).

Depending on your setup, you could use client response headers to implement your security policy, as this will not result in this error.

If your issues are only related to running in debug mode (using meta tags), this is not a solution for you.