Angular 18.2.x: Strict csp not working when we have aot false and CSP as script-src 'self'...

With aot false and script-src 'self' 'nonce-XYZABC'; we are getting below error in browser console

EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'nonce-XYZABC". at below line in compiler.mjs file const fn = _global'eval';

eval getting blocked by strict CSP.

Error is at below line in compiler.mjs file eval getting blocked by strict CSP

https://github.com/angular/angular/.../core/src/util/security/trusted_types.ts#L129

Is there any fix or to support strict csp with aot false ??

Continue reading...