I have a little problem with my application. I want to configure a CSP Header to counter all XSS potential vulnerabilities. But I have this error :
Uncaught EvalError: call to eval() blocked by CSP DomQuery http://localhost/lib/js/extjs/pkgs/ext-core.js:21<anonymous> http://localhost/lib/js/extjs/pkgs/ext-core.js:21This is my configuration :
Header always set Content-Security-Policy "default-src 'self'; style-src 'self''unsafe-inline'; script-src 'unsafe-inline''self'"Do you have a solution please ? Thanks u !
I try to add unsafe eval but it is not secure..