TWA 0218

TWA-0218

Message

"Content-Security-Policy has one or more 'unsafe-eval' policies"

Explanation

The Content-Security-Policy is sent from the web server to the web browser in the HTTP header. The Content-Security-Policy directives allows a stricter protection of the web page content by the web browsed.

The Content-Security-Policy is a field in the header of the HTTP response. The value is a string with internal structure, a list of one or more directives. The unsafe-eval directive allows dynamic executing code, e.g. activates the eval function of JavaScript.

Remediation

Remove all unsafe-eval directives from the Content-Security-Policy in the web server configuration.

Only use the unsafe-eval, if the web application needs the setting. Consider changing the web application to work without dynamic script code / without unsafe-eval in the Content-Security-Policy.

See

• MDN web docs: Content Security Policy
• OWASP Content Security Policy Cheat Sheet