We have a security requirement due to which we need to add CSP headers in our app. Following the the nginx configuration we are using for the same:
add_header Content-Security-Policy "default-src 'self' ${URL} script-src 'self' 'nonce-$request_id'; object-src 'self'; img-src 'self' blob: data:; font-src 'self'; media-src 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';"
After adding this, we are getting unsafe-eval exception in the browser.
The error is because some code in telemetry.min.js is using eval, which is not recommended from security perspective.
We are looking for an efficient solution for this, but a quick fix would also be really helpful.
We have a security requirement due to which we need to add CSP headers in our app. Following the the nginx configuration we are using for the same:
After adding this, we are getting
unsafe-evalexception in the browser.The error is because some code in telemetry.min.js is using eval, which is not recommended from security perspective.
We are looking for an efficient solution for this, but a quick fix would also be really helpful.