title: Angular 5 & CSP - Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script
body: <p>I'm currently experimenting with introducing a Content Security Policy to my application that is built using Angular 5. I'm currently implementing the CSP using a <code>meta</code> tag in my index.html although I will change this in the future. I have inserted the following into my app</p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="script-src 'self'; img-src 'self' data:;media-src 'self'; object-src 'self' data: 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline';"&gt;
  </code></pre>
  
  <p>This pretty much covers my needs however when I deploy to a testing server the Browser Console gives me the following message: </p>
  
  <blockquote>
    <p>Uncaught EvalError: Refused to evaluate a string as JavaScript because
    'unsafe-eval' is not an allowed source of script in the following
    Content Security Policy directive: "script-src 'self'".</p>
  </blockquote>
  
  <p>Okay, so I need to add the <code>'unsafe-eval'</code> to the <code>script-src</code> directive. That's not really a problem but it does seem to make me worried remembering that eval() is evil!</p>
  
  <p>For Angular 5 applications that wish to use a CSP is it necessary to have to include <code>'unsafe-eval'</code> to the <code>script-src</code> directive? Is there a way I can retain the security feature preventing the use of <code>eval()</code>? Is it necessary to include this as Angular uses <code>eval()</code>.  I am assuming that the content of the Content-Security-Policy meta tag is correct although I am sure it may not be the case.</p>
  
  <p>I read this Issue on the angular github <a href="https://github.com/angular/angular/issues/19142" rel="nofollow noreferrer">https://github.com/angular/angular/issues/19142</a> but I am unsure if this issue is relevant to me as I am not using SystemJS but webpack in my application? </p>
  
  <p>Many thanks in advice for help, answers and suggestions.</p>