#268·cap

[bug] CSP - force usage of 'unsafe-eval' in script-src - 2

Author: dioupCreated Jun 8, 2026Updated Jul 27, 2026

Labelsbug

bug description: This issue follows this previous issue #266 ,

affects:

[] standalone
widget (ui)
widget (wasm solver)
[] js server
js solver

to reproduce: View previous issue

expected behavior: View previous issue

screenshots: I'm running a django app, and this is the base.html file and all my other .html file heritate from it.

python

        <script nonce="{{ csp_nonce }}">
            window.CAP_CSS_NONCE = "{{ csp_nonce }}";
            window.CAP_SCRIPT_NONCE = "{{ csp_nonce }}";
        </script>
        <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.bundle.min.js"
                integrity="sha384-FKyoEForCGlyvwx9Hj09JcYn3nv7wiPVlz7YYwJrWVcXK/BmnVDxM+D2scQbITxI"
                nonce="{{ csp_nonce }}"
                crossorigin="anonymous"
                defer></script>
        <script src="https://cdn.jsdelivr.net/npm/[email protected]/cap.min.js"
                crossorigin="anonymous"
                nonce="{{ csp_nonce }}"
                defer></script>
        <script src="https://cdn.jsdelivr.net/npm/[email protected]/cap-floating.min.js"
                nonce="{{ csp_nonce }}"
                crossorigin="anonymous"
                defer></script>
        {% block extra_js %}
        {% endblock extra_js %}
    </body>
</html>

And the final page implements cap as is:

python

{% if CAP_WIDGET_ENDPOINT %}
                                <div class="mb-3">
                                    <cap-widget id="floating" data-cap-api-endpoint="{{ CAP_WIDGET_ENDPOINT }}"></cap-widget>
                                    {% for error in form.captcha.errors %}<div class="invalid-feedback d-block">{{ error }}</div>{% endfor %}
                                </div>
                            {% endif %}

The CSP configuration is the following:

python

SECURE_CSP = {
    "default-src": [CSP.SELF],
    "script-src": [
        CSP.SELF,
        CSP.NONCE,
        "'wasm-unsafe-eval'",
    ],
    "connect-src": [
        CSP.SELF,
        CSP.NONCE,
        # "https://cdn.jsdelivr.net/npm/cap-widget",
        "https://cdn.jsdelivr.net/npm/@cap.js/",
        # "https://cdn.jsdelivr.net/npm/bootstrap",
        "https://cap.eurecom.cafe/",
    ],
    "style-src": [
        CSP.SELF,
        CSP.NONCE,
        # "'unsafe-hashes'",
        # "'sha256-MhtPZXr7+LpJUY5qtMutB+qWfQtMaPccfe7QXtCcEYc='",
    ],
    "img-src": [CSP.SELF, "data:"],
    "font-src": [
        CSP.SELF,
        "https://cdn.jsdelivr.net/npm/[email protected]/font/fonts/",
    ],
    "script-src-elem": [CSP.SELF, "'unsafe-inline'", "https://cdn.jsdelivr.net", ],
    "style-src-elem": [
        CSP.SELF,
        CSP.NONCE,
    ],
    "form-action": [CSP.SELF],
    "frame-src": [CSP.NONE],  # reCAPTCHA iframe
    "frame-ancestors": [CSP.NONE],
    "base-uri": [CSP.SELF],
    "worker-src": [CSP.SELF, "blob:"],
}

versions and environment: Firefox 148.0/Linux Mint/ Cap 1.55

additional context: I read the documentation regarding CSP and my main question is: does unsafe-eval need to be activated in order to make it work?

Thanks for your time and your help.

Source: tiagozip/cap

View original on GitHub View discussion on GitHub