Unsafe-Eval listed but still blocked

[binarykitchen]

I have these policies:

    var policy = {
        defaultPolicy: {
            'default-src': [
                "'self'",
                "data:",
                "'unsafe-inline'",
                "'unsafe-eval'"
            ],
            'img-src': [
                "'self'",
                "data:",
                "www.google-analytics.com"
            ],
            'script-src': [
                "'self'",
                "'unsafe-inline'",
                "'unsafe-eval'",
                "www.google-analytics.com"
            ]
        }
    };

    helmet.csp.policy(policy);

    app.use(helmet.csp());

but still, Firefox complains with:

---

Content Security Policy: The page's settings blocked the loading of a resource: An attempt to call JavaScript from a string (by calling a function like eval) has been blocked

call to eval() or related function blocked by CSP

---

Huh? I am allowing unsafe-evals here. Can anyone explain?

[EvanHahn]

Could you paste what the HTTP header is?

[EvanHahn]

I'm going to close this issue because it seems inactive (and is about old code).

[binarykitchen]

Right, it is working fine now. Sorry for not replying earlier ...