CSP 'unsafe-eval'

Permits eval(), new Function() and string-argument setTimeout.

Falls back to

nothing — must be set explicitly

Group

Source keywords

Detail

Less severe than unsafe-inline — an attacker still needs script execution first — but it widens what an injection can do and blocks the use of Trusted Types. Some older template engines and a few WASM toolchains require it; most modern frameworks do not.

Example

Analyse a full policy → · Generate one →