Remove 'unsafe-eval' from script-src on Shopify

Why it matters

'unsafe-eval' lets text be run as code through eval() and similar functions, which turns many injection bugs into code execution. Most current libraries no longer need it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Shopify's own header has no fetch directives, so this policy comes from a meta http-equiv Content-Security-Policy tag in your theme (layout/theme.liquid or a snippet it renders) or from an app. In Online Store, Themes, Edit code, search for Content-Security-Policy; if an app prints the tag, ask its developer.
2. Stage 1: duplicate the theme, remove 'unsafe-eval' from the tag's content value in the copy, and preview it with the developer console open on the home, product, collection and cart pages. A theme or app script that still calls eval() shows up as a blocked script.
3. Stage 2: publish the copy once nothing the store needs is blocked; if something is, keep 'unsafe-eval' until that script is updated.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Add a Content-Security-Policy
• Enforce the report-only Content-Security-Policy
• Send the Content-Security-Policy as an HTTP header
• Restrict where scripts can load from
• Replace 'unsafe-inline' scripts with nonces or hashes
• Remove wildcard sources from script-src
• Set object-src to 'none'
• Add base-uri to the Content-Security-Policy
• Reduce reliance on inline styles
• Fix the Content-Security-Policy syntax