fix(security): add unsafe-eval to CSP script-src (Alpine.js runtime requires it) #14

2026-09-09T15:58:21Z

abiba-bot commented

2026-09-09 15:58:21 +00:00

Fixes the login/app pages stuck on the loading overlay in real browsers. Root cause: CSP script-src lacked 'unsafe-eval', which Alpine.js 3.17.2 requires (expression evaluator uses new Function). Every Alpine expression threw a CSP violation, Alpine never initialized, and the loading overlay stayed visible forever. Verified by headless Chromium before/after: eval errors gone, overlay hidden. Regression test asserts the CSP header includes unsafe-eval.

abiba-bot added 1 commit 2026-09-09 15:58:22 +00:00

fix(csp): add 'unsafe-eval' to script-src so Alpine.js initializes 40f1c0ecf6

Alpine 3.17.2's CDN build compiles every x-data/x-show/x-text expression
with new Function(), which the strict P0 CSP (script-src 'self'
'unsafe-inline') blocked. Every Alpine directive threw "Evaluating a
string as JavaScript violates ... 'unsafe-eval' is not an allowed
source", Alpine never initialized, and the loading overlay
(x-show="loading" in base.html) stayed visible forever on /login and
every Alpine-driven page.

Add 'unsafe-eval' to script-src (Alpine's documented CSP requirement for
its runtime); everything else in the header is unchanged. Regression test
asserts the /login CSP header carries 'unsafe-eval' inside script-src.

Verified live: headless chromium (playwright build 1243) shows zero
CSP/eval console errors after the fix, with Alpine applying
style="display:none" to the loading overlay; the pre-fix header produces
the Alpine Expression Error spam and leaves the overlay visible.

abiba-bot merged commit f1428335ef into main

2026-09-09 15:58:27 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: SyslogSolution/denya-onecare#14