Content Security Policy (CSP) - safe usage of unsafe-eval?

Question

We use the following CSP header:

default-src \'self\' *.ourdomain.com; script-src \'self\' *.ourdomain.com \'sha256-[...]\' \'unsafe-eval\'; 
connect-src \'self         


        

Answer 1

The security risk is that it doesn't protect any of your own code that may be vulnerable because eval is used.

If you are using eval in your own code you should question why. Is there a safer alternative that can be employed instead?

See here for a (contrived) example of how code can be injected by an attacker. Of course whether this can be done to your site very much depends on your code.

The upshot is that there's almost always an alternative to using eval.