I am trying to use the Facebook Javascript SDK in my web application that I am protecting with CSP. I added “connect.facebook.net” to my CSP list “script-src” and the SDK is loading.
But it looks like the SDK is trying to evaluate the string as Javascript

(source: free.fr )
How can I use the Facebook SDK without adding "unsafe-eval" to my CSP? Is there a version of this SDK for CSP?
Thank :)
source
share