title: Source: call to eval() or related function blocked by CSP
body: <p>I am receiving the following error:</p>
  
  <blockquote>
    <p><em>Content Security Policy: The page’s settings blocked the loading of a resource at self (“default-src”). Source: call to eval() or related
    function blocked by CSP.</em></p>
  </blockquote>
  
  <p>The site is running Laravel, but I have introduced a simple <code>index.html</code> to rule out that possibility:</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html lang="en"&gt;
  &lt;head&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Which gives thew same error.</p>
  
  <p>Here is the relevant code from <code>httpd.conf</code></p>
  
  <blockquote>
    <p>httpd-2.4.6-80.el7.centos.1.x86_64</p>
  </blockquote>
  
  <pre><code>&lt;IfModule mod_headers.c&gt;
    &lt;Directory /&gt;
      Header always set X-XSS-Protection "1; mode=block"
      Header always set x-Frame-Options "SAMEORIGIN"
      Header always set X-Content-Type-Options "nosniff"
      Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
      Header always set Content-Security-Policy "default-src 'self' *.pusher.com; img-src 'self'; style-src *.fontawesome.com https://fonts.gstatic.com https://fonts.googleapis.com; font-src *.fontawesome.com https://fonts.gstatic.com;"
      Header always set Referrer-Policy "strict-origin"
    &lt;/Directory&gt;
  </code></pre>
  
  <p></p>
  
  <p>I have also attempted using my domain <code>default-src *.domain.com;</code> with the same result</p>
  
  <p><strong>EDIT:</strong> Is this what you mean?
  This is a 'view source' of the `index.html as the server sees it, with the error as shown when viewing that page via the browser. Also since the site is locked to only a handful of IP addresses, i would find it very odd if something is being injected</p>
  
  <p><a href="https://i.stack.imgur.com/VJPGj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VJPGj.png" alt="enter image description here"></a></p>