# Content Security Policy (CSP) issues **URL:** \ **Category:** WebViewer\ **Created:** [December 6, 2025, 3:44pm UTC](https://forum.mupdf.com/t/content-security-policy-csp-issues/225 "2025-12-06T15:44:29Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![IsaacWebber](https://yyz2.discourse-cdn.com/flex004/user_avatar/forum.mupdf.com/isaacwebber/32/298_2.png) [@IsaacWebber](https://forum.mupdf.com/u/IsaacWebber)\ **Post date:** [December 6, 2025, 3:44pm UTC](https://forum.mupdf.com/t/content-security-policy-csp-issues/225/1 "2025-12-06T15:44:29Z")
Hi, we are currently integrating the mupdf web viewer into our application and we are encountering 2 Content Security Policy (CSP) issues. 1. It appears that your current minified build has a line where a function is created from a string. I’ve attached a screenshot of this. This triggers a CSP violation unless we enable the ‘unsafe-eval’ directive, which we cannot do for security reasons. Is there a workaround for this? 2. The library appears to create an iframe with inline tags, these are also blocked by our CSP. To allow these to run we would need a configuration option to pass a nonce hash to them. Is there a way to do this already that I have missed or would it be possible to add this? ---
**Author:** ![Jamie\_Lemon](https://yyz2.discourse-cdn.com/flex004/user_avatar/forum.mupdf.com/jamie_lemon/32/5_2.png) [@Jamie\_Lemon](https://forum.mupdf.com/u/Jamie_Lemon)\ **Post date:** [December 8, 2025, 1:27pm UTC](https://forum.mupdf.com/t/content-security-policy-csp-issues/225/2 "2025-12-08T13:27:44Z")
Hi @IsaacWebber welcome to the forum and thanks for the post. Could you supply the screenshot, for some reason it wasn’t attached. I’ll chase up these issues with our WebViewer engineering team. ---
**Author:** ![IsaacWebber](https://yyz2.discourse-cdn.com/flex004/user_avatar/forum.mupdf.com/isaacwebber/32/298_2.png) [@IsaacWebber](https://forum.mupdf.com/u/IsaacWebber)\ **Post date:** [December 8, 2025, 2:22pm UTC](https://forum.mupdf.com/t/content-security-policy-csp-issues/225/3 "2025-12-08T14:22:06Z")
Thanks for the reply, that’s my bad here is the screenshot ![Screenshot 2025-12-04 at 14.12.20](https://canada1.discourse-cdn.com/flex004/uploads/mupdf/original/1X/ead38cb1956bbad1d6323c0d8ceb27b28d7167a3.png) Also worth noting that we’ve also noticed we are getting similar CSP issues with inline event listeners as well. ---
**Author:** ![Jamie\_Lemon](https://yyz2.discourse-cdn.com/flex004/user_avatar/forum.mupdf.com/jamie_lemon/32/5_2.png) [@Jamie\_Lemon](https://forum.mupdf.com/u/Jamie_Lemon)\ **Post date:** [December 11, 2025, 5:13pm UTC](https://forum.mupdf.com/t/content-security-policy-csp-issues/225/4 "2025-12-11T17:13:22Z")
@IsaacWebber It looks like for us to be able to adhere to your CSP that we might need to find some way of injecting a nonce into all the inline JS at build time. Can you confirm that your CSP is something like this: Content-Security-Policy: default-src ‘self’; script-src ‘self’; ---
**Author:** ![IsaacWebber](https://yyz2.discourse-cdn.com/flex004/user_avatar/forum.mupdf.com/isaacwebber/32/298_2.png) [@IsaacWebber](https://forum.mupdf.com/u/IsaacWebber)\ **Post date:** [December 11, 2025, 5:47pm UTC](https://forum.mupdf.com/t/content-security-policy-csp-issues/225/5 "2025-12-11T17:47:42Z")
Hi, our CSP is Content-Security-Policy “script-src ‘nonce-$request\_id ‘strict-dynamic’;” the nonce is generated per page load as stated here [HTML nonce global attribute - HTML | MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/nonce#:%5C~:text=From%20your,nodejs) and so injecting this at build time wouldn’t work. So we would need a way of passing it in at runtime. This will solve the issue with the unsafe inlines. The other issues with the unsafe evals & and inline event listeners would have to be moved into the scripts with the nonces so they are marked as safe to run. ---
**Author:** ![Jamie\_Lemon](https://yyz2.discourse-cdn.com/flex004/user_avatar/forum.mupdf.com/jamie_lemon/32/5_2.png) [@Jamie\_Lemon](https://forum.mupdf.com/u/Jamie_Lemon)\ **Post date:** [December 11, 2025, 5:49pm UTC](https://forum.mupdf.com/t/content-security-policy-csp-issues/225/6 "2025-12-11T17:49:29Z")
Okay - thanks for the info - we will look into this further. ---
**Author:** ![Jamie\_Lemon](https://yyz2.discourse-cdn.com/flex004/user_avatar/forum.mupdf.com/jamie_lemon/32/5_2.png) [@Jamie\_Lemon](https://forum.mupdf.com/u/Jamie_Lemon)\ **Post date:** [February 9, 2026, 12:54pm UTC](https://forum.mupdf.com/t/content-security-policy-csp-issues/225/7 "2026-02-09T12:54:25Z")
@IsaacWebber Please note the latest version of WebViewer has some improvements for CSP, see: [CHANGELOG - MuPDF WebViewer](https://webviewer-docs.mupdf.com/api-reference/changelog#etc) - go for the 0.13.2 if you upgrade.