[▲ Vercel Community](/) · [Categories](/categories) · [Latest](/latest) · [Top](/top) · [Live](/live)

[Feedback](/c/feedback/8)

# Create a note in CSP Documentation regarding `'unsafe-eval'` locally

77 views · 2 likes · 4 posts


Jonahallibone (@jonahallibone) · 2024-12-11

I was wondering if it were possible to create a note on the CSP documentation page that explicitly says that without `'unsafe-eval'` being allowed locally, you will not be able to use HMR/fast refresh during development. This was a painpoint for us for the past few weeks, and something i did not uncover until I started reading the WS messaging produced by `webpack-hmr` to find the root of the issue.

`process.env.NODE_ENV === "development" ? "'unsafe-eval'" : "",` is the gist of it.


Amy Egan (@amyegan) · 2024-12-11

If you're using Next.js 15, [Server Components HMR](https://nextjs.org/blog/next-15#server-components-hmr) configuration might be a safer option. Please give this a try and let me know if it works for your project :slightly_smiling_face: 

https://nextjs.org/docs/app/api-reference/config/next-config-js/serverComponentsHmrCache


Jonahallibone (@jonahallibone) · 2024-12-11 · ♥ 1

Hi @amyegan! We are actually still on the pages router for now (Next 14 as well). We have our CSP configured in our `next.config.js`, which is why I was hoping to see this documented!


Amy Egan (@amyegan) · 2024-12-11 · ♥ 1

Understood. I'll share this info with the docs team so we can figure out the best way to document this scenario. Thanks for making the suggestion!