title: Content Security Policy (CSP) - safe usage of unsafe-eval?
body: <p>We use the following CSP header: </p>
  
  <pre><code>default-src 'self' *.ourdomain.com; script-src 'self' *.ourdomain.com 'sha256-[...]' 'unsafe-eval'; 
  connect-src 'self' *.ourdomain.com; 
  style-src 'unsafe-inline' * 'self' data:; font-src *; 
  img-src * 'self' data:
  </code></pre>
  
  <p>The recommendation by our security team is not use unsafe-eval.</p>
  
  <p>My question is: as long as we are using <strong>sha256-[...]</strong> to restrict any script that we haven't deployed ourselves, what is the security risk of still keeping <strong>unsafe-eval</strong> in the CSP header? In what situation would this still expose us to cross-site attacks?</p>