I added the following to a web page:

<script type="text/javascript">
  window.addEventListener("load", function () {
    window.location = "https://localhost:5002";
  });
</script>

When I run the application I get the following error:

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "default-src 'self'"

When I remove the script I do not get the error anymore.

Any idea why this happens?

I added the following to a web page:

<script type="text/javascript">
  window.addEventListener("load", function () {
    window.location = "https://localhost:5002";
  });
</script>

When I run the application I get the following error:

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "default-src 'self'"

When I remove the script I do not get the error anymore.

Any idea why this happens?

• javascript
• webpack

• Error shown has nothing to do with that code. – StackSlave Commented Sep 10, 2020 at 22:30
• I updated my question ... When I have the script in the page I get the error. When I delete the script I do not have the error. Any idea why? I already tried to move it to an external JS file and the same happens. – Miguel Moura Commented Sep 10, 2020 at 22:51
• 1 developer.mozilla/en-US/docs/Web/HTTP/Headers/… – Taplar Commented Sep 10, 2020 at 22:52
• I checked the mozilla url and I can't find a reason for getting that error. I even made my code simpler (update my question) but the error persists. I am running the site on localhost:5000 and on one page redirecting to localhost:5002. So I really have no idea what might be wrong. – Miguel Moura Commented Sep 10, 2020 at 23:08

2 Answers 2

For other people that might e across something similar: developing a plugin for an electron app i got this error when i was trying to load it. The solution was to just change the mode to "production" in webpack.config.js.

Your current CSP setting is:

"default-src 'self'"

which means that you can only execute your code from your root URL (localhost:5000).

You can try to extend this policy to the other URL you are using:

"default-src 'self' https://localhost:5002"

The CSP setting location depends on your web server. In case of Apache, this is set in file '.htaccess'.

P.S: 'unsafe-eval' doesn't seem to be related to the listener you are adding, but you can try the above change anyway.