vue3 with vue-i18n-next only works with unsafe-eval CSP header
See original GitHub issueWhile trying to update to Vue3, we have noticed that apps won’t work with CSP headers that don’t allow unsafe-eval. Apparently this is because the newest vue-i18n is using eval, are there any plans to fix this, or will Vue3 apps require unsafe-eval moving forward?
Module versions (please complete the following information):
vue
: 3.0.11vue-i18n
: 9.1.6
To Reproduce Steps to reproduce the behavior: ex:
- set Content-Security-Policy header with a script-src that doesn’t contain unsafe-eaval
- try to use any vue3 app that contains vue-i18n-next
- See error in browser console
Expected behavior In many organizations the security guidelines dictate that CSP headers are set and unsafe-eval is usually not allowed
Issue Analytics
- State:
- Created 2 years ago
- Reactions:1
- Comments:6 (3 by maintainers)
Top Results From Across the Web
How to fix "unsafe-eval" error with Vue3 for the client-side ...
Yes, vue.js uses a piece of code like that: // detect possible CSP restriction try { new Function('return 1'); } catch (e) {...
Read more >Vue Content Security Policy Guide - StackHawk
A CSP works by allowing the server to provide a response header telling the browser to only execute resources vetted by a legitimate...
Read more >CSP: script-src - HTTP - MDN Web Docs - Mozilla
If a page has a CSP header and 'wasm-unsafe-eval' isn't specified in the script-src directive, WebAssembly is blocked from loading and executing ...
Read more >How To Secure Node.js Applications with a Content Security ...
Leave your app running and open a new terminal window to work with your server.js file: nano server.js. Next, add the CSP header...
Read more >CSP - problem with eval - Get Help - Vue Forum
I am trying to set CSP headers in my Vue 2.0 app and I have a problem with 'eval' policy. When I use...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
An alternative is:
So, can create a function to otimize:
messages.value?.[locale.value]?.example
Ex:
Thank you, I will have a look