title: Content Security Policy and Google Maps API v3
body: <p>I am using CSP and all is going well. I allow my own inline scripts using a nonce but now I've got a problem with Google Maps.</p>
  
  <p>I've searched everywhere but all SO questions are about Chrome extensions whereas I'm building a website that uses Google Maps.</p>
  
  <p>I get these 2 errors in the console</p>
  
  <blockquote>
    <p>Refused to evaluate a string as JavaScript because 'unsafe-eval' is
    not an allowed source...
    Uncaught EvalError: Refused to evaluate a string
    as JavaScript because 'unsafe-eval' is not an allowed source...</p>
  </blockquote>
  
  <p>I've seen also about using a sandbox but am unsure how to do this. Does anyone know how to do this?</p>
  
  <p>Do I add unsafe-eval (which i don't want to do) to my CSP headers just for specific pages and if so, will the whole site be compromised?</p>