I'm in charge of building an application with Angular 12.0.5. Our developing guidelines states that we are not allowed to use inline javascript and that we have to use a Content Security Policy that prevents inline javascript. Therefore I added this to my Index.html: <meta http-equiv="Content-Security-Policy" content="default-src 'self';style-src 'unsafe-inline' 'self';script-src 'self';"> This works nicely as long I work with node dev-server which I start with npm start. But when I build this website with ng build and deploy it to the productive web server I see this error in my developer console and my application stops working: Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'self' … This error disappears when I remove the CSP. Any idea how I can make this work without removing the CSP ? Continue reading...
