Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' https://…"
What causes it and how to fix it:
- The tenant's CSP is inherited by srcdoc frames — inline scripts in embedded HTML never runModern pages send script-src without 'unsafe-inline', and a document you build yourself (srcdoc, blob:, data:) inherits it, so every inline script in the embedded HTML is dropped; an external file from an allow-listed source (including 'self') still runsCause and fix →