# Issue: Content Security Policy 'unsafe-eval' Conflict using HTML5 FMOD

**URL:** https://qa.fmod.com/t/issue-content-security-policy-unsafe-eval-conflict-using-html5-fmod/20858
**Category:** FMOD Engine
**Tags:** javascript, html5, cpp
**Created:** [November 9, 2023, 5:55am UTC](https://qa.fmod.com/t/issue-content-security-policy-unsafe-eval-conflict-using-html5-fmod/20858 "2023-11-09T05:55:30Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![aishi1](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@aishi1](https://qa.fmod.com/u/aishi1)
#### Post date: [November 9, 2023, 5:55am UTC](https://qa.fmod.com/t/issue-content-security-policy-unsafe-eval-conflict-using-html5-fmod/20858/1 "2023-11-09T05:55:30Z")

</div>

Hello,

I’m starting to build a frontend for a website that will use FMOD for audio.  
For security purposes (and it looks like it is widely considered as a security best practice), I have turned off ‘unsafe-eval’ for all browser scripts.

But now the browser throws an error when calling `FMODModule` due to a function in fmod\_reduced.js called `createNamedFunction` that is running some dynamic JS. (I’m currently using the wasm version)

After looking around for answers I found that you can turn off the generation of unsafe-eval-related JS in emcc by passing `-s NO_DYNAMIC_EXECUTION=1`, but according to [this issue](https://github.com/emscripten-core/emscripten/issues/5911), it looks like later versions of Emscripten actually have removed use of eval.

Would it be a possibility to make this change in your HTML5 distribution?  
In the meantime, I’m going to see if linking the static library with that flag could work.

Thanks,  
Aaron

---

<div class="post-metadata">

### Author: ![aishi1](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@aishi1](https://qa.fmod.com/u/aishi1)
#### Post date: [November 11, 2023, 5:24am UTC](https://qa.fmod.com/t/issue-content-security-policy-unsafe-eval-conflict-using-html5-fmod/20858/2 "2023-11-11T05:24:23Z")

</div>

Just wanted to follow up that linking to the static library with the `-s NO_DYNAMIC_EXECUTION=1` flag isn’t working for the same reason.

Here are the error messages from Chrome’s console:

 ![Screenshot 2023-11-10 at 9.19.39 PM](https://canada1.discourse-cdn.com/flex036/uploads/fmod/original/2X/7/78bb6d4353a53400c6c40fd63a3a4c324960d603.png)

---

<div class="post-metadata">

### Author: ![aishi1](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@aishi1](https://qa.fmod.com/u/aishi1)
#### Post date: [November 11, 2023, 7:09am UTC](https://qa.fmod.com/t/issue-content-security-policy-unsafe-eval-conflict-using-html5-fmod/20858/3 "2023-11-11T07:09:25Z")

</div>

After some searching I found this [MDN article](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_webassembly_execution) that mentions that in order to use WebAssembly with a CSP header at all, you need to enable `script-src 'wasm-unsafe-eval'`.

After running the code with this header change, both Chrome and Safari threw an error mentioning that it could not load a blob from `blob:http://localhost:<port><filename>`. (I’m not sure if this is the .wasm file paired with the .js or not, because the filename was a GUID-like string of hex characters and dashes)

Anyway, setting the policy to `script-src 'self' 'wasm-unsafe-eval' blob:` it works now in both Chrome & Safari. (It also works with the pre-built fmod js)