title: How to allow unsafe-eval and Remote Script - CSP Content Security Policy
body: <p>"GOOGLE EXTENSION WEB APP"</p>
  
  <p>Drives me nuts. </p>
  
  <p>I can't manage to have unsafe-eval and remote script both working. </p>
  
  <p>I can have unsafe eval but the remove script doesn't work. And vice verso. </p>
  
  <p>What failed: </p>
  
  <p>Eval and Remote</p>
  
  <p><code>"content_security_policy": "script-src  https://connect.facebook.net 'unsafe-eval'; object-src 'self' "</code></p>
  
  <p>What works:</p>
  
  <p>Only Remote</p>
  
  <p><code>"content_security_policy": "script-src  'self'  https://connect.facebook.net; object-src 'self' "</code></p>
  
  <p>Only Eval</p>
  
  <p><code>"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self' "</code></p>
  
  <p>How to have both ?</p>