sapui5 CSP(content-security-policy) script-src 'unsafe-eval';

[#1]

Dear SAP community,

I'm getting an error like this,

"failed to load 'sap/ui/core/library-preload' (Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' https:"."

not only core, it also refused sap/m, sap/ui/commons, sap/ui/table...etc.

If i set 'unsafe-eval' in CSP it is working perfectly. But 'unsafe-eval' will allow everything. so, instead of 'unsafe-eval' what i can give there.

version : 1.60

[boghyon · Accepted solution]

1. Ensure that your application runs with one of the maintained SAPUI5 versions with the latest patch number. 1.60 is out of maintenance.
2. To allow your app running with the CSP script-src directive that excludes unsafe-eval, follow the "Resolution" section in https://stackoverflow.com/a/74959324/5846045.