1

Is it possible to configure "content security policy" for domains like *.googleapis.com where I'll have unsafe-eval enabled, but for my own website (self) it will be disabled?

I looked at the doc, Internet, RFCs for hours and found nothing about that. Seems like it's impossible, wanted to ask community.

sideshowbarker
  • 72,859
  • 23
  • 167
  • 174
Roman Pushkin
  • 5,139
  • 1
  • 34
  • 56
  • 1
    You can’t enable unsafe-eval per-source. See, e.g., item 1 in the answer at https://stackoverflow.com/questions/10944794/csp-how-to-allow-unsafe-eval-for-a-given-uri-prefix-firefox/10949133#10949133 – sideshowbarker Aug 21 '17 at 18:08

0 Answers0