Question about CSP

[242816]

I couldn't find a statement about a Content Security Policy.

I usually have a very tight CSP that basically disallows almost everything. It's the last line of defence.

Ideally I'd like to keep it that way but maybe I would need to open up the CSP for datastar to work?

I'm assuming there's some use of eval.

Thanks.

[bencroker]

Yes, to use data-* expressions requires unsafe-eval at the very least. Added to the docs in #456.

<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-eval';">

[242816]

@bencroker Thanks.