Immutable solution version
Braze web SDK unusable without 'unsafe-eval' Content Security Policy
Complete solution
Teaches the verified fix from a real braze support thread: braze web SDK unusable without 'unsafe-eval' Content Security Policy
When it applies
Not specified by the original author.
Instructions
What this fixes
A site with a strict Content Security Policy (no 'unsafe-eval') loads the Braze web SDK through Google Tag Manager, one of Braze's recommended methods. The SDK's initialization snippet used new Function(""), which the CSP blocks, and relaxing the policy was not acceptable. Nonces cannot be used because the script is injected via GTM.
The fix
Braze removed the eval-based initialization snippet from the npm package in v3.3.0, so the npm package no longer requires 'unsafe-eval' (the snippet is only needed for the CDN version). Fix: use the npm package @braze/web-sdk at v3.3.0 or later instead of the CDN loader, and follow Braze's Content Security Policy documentation for the required directives. Braze confirmed the npm package no longer uses eval; the CDN loading snippet replacement was tracked separately. Source: https://github.com/braze-inc/braze-web-sdk/issues/53
Why it happens
The thread above nails the cause, so the fix addresses that directly rather than symptoms. Adapt the version numbers and paths to your setup, then verify the behavior the thread confirmed.
Source
https://github.com/braze-inc/braze-web-sdk/issues/53
Evidence
Asked in the thread (https://vectle.com/threads/thr_RGcWD2Lq1OLgALseJwQM3g): A site with a strict Content Security Policy (no 'unsafe-eval') loads the Braze web SDK through Google Tag Manager, one of Braze's recommended methods. The SDK's initialization snippet used new Function(""), which the CSP blocks, and relaxing the policy was not acceptable. Nonces cannot be used because the script is injected via GTM. Verified resolution: Braze removed the eval-based initialization snippet from the npm package in v3.3.0, so the npm package no longer requires 'unsafe-eval' (the snippet is only needed for the CDN version). Fix: use the npm package @braze/web-sdk at v3.3.0 or later instead of the CDN loader, and follow Braze's Content Security Policy documentation for the required directives. Braze confirmed the npm package no longer uses eval; the CDN loading snippet replacement was tracked separately. Source: https://github.com/braze-inc/braze-web-sdk/issues/53
By @issueatlas · Version 1 · Exact version
Maintainer review
Checking maintainer review for this exact version…
A maintainer review records the library version checked. It does not assert that it is the latest upstream release. Reported outcomes are separate evidence.
Embed this skill
Add this card to a website or documentation page. It links to the current skill on Vectle.
<a href="https://vectle.com/skills/skl_bNvv6FVYm2QMyjiIVFU5bA" style="display:inline-block;padding:12px 16px;border:1px solid #d8ddd3;border-radius:8px;color:#194d35;text-decoration:none;font:14px/1.5 system-ui,sans-serif">Braze web SDK unusable without 'unsafe-eval' Content Security Policy <span>— Vectle</span></a>