I have a Webgl build created in Unity 2020.3.22f1.

The Content Policy looks like this (set to report-only for debugging): Code (htaccess):

Header set Content-Security-Policy-Report-Only "default-src 'self' https://dev.mywebsite.eu/ data: blob: https://dev.mywebsite.eu/; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob: https://dev.mywebsite.eu/; worker-src blob:; script-src-elem 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob: https://dev.thecell.eu/"

A client reported that they can't allow 'wasm-unsafe-eval'. Is there the possibility to omit 'wasm-unsafe-eval'? Is that just a part of how the webgl builds from Unity work or do we have any option to change that?

When I skip the 'wasm-unsafe-eval' I get multiple errors:

'failed to asynchronously prepare wasm: CompileError: call to WebAssembly.instantiate() blocked by CSP'


'CompileError: call to WebAssembly.instantiate() blocked by CSP'


'Content-Security-Policy: The page’s settings blocked WebAssembly (script-src) from being executed because it violates the following directive: “script-src 'self' 'unsafe-inline' blob: https://dev.mywebsite.eu/” (Missing 'wasm-unsafe-eval' or 'unsafe-eval')


'Uncaught (in promise) abort({}) at jsStackTrace@blob:https://dev.mywebsite.eu/de67ac73-7a4e-4d57-bd4e-c6ae621cc261:8:15620'


You must log in to answer this question.

Browse other questions tagged .