From 3eef1c216d0aa182a809d5709d66cd5e3cdea495 Mon Sep 17 00:00:00 2001
From: knylbyte <philippmielke@icloud.com>
Date: Mon, 18 Aug 2025 17:41:54 +0200
Subject: [PATCH] Add wasm-unsafe-eval to default csp script-src header

---
 backend/src/api/endpoints/web_index.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/src/api/endpoints/web_index.rs b/backend/src/api/endpoints/web_index.rs
index fdbfc4299..1ebb4b707 100644
--- a/backend/src/api/endpoints/web_index.rs
+++ b/backend/src/api/endpoints/web_index.rs
@@ -172,7 +172,7 @@ async fn index(
             {
                 let mut attrs = vec![
                     "default-src 'self'".to_string(),
-                    format!("script-src 'self' 'nonce-{nonce_b64}'"),
+                    format!("script-src 'self' 'wasm-unsafe-eval' 'nonce-{nonce_b64}'"),
                     "frame-ancestors 'none'".to_string(),
                 ];
                 attrs.extend(csp.custom_attributes.iter().cloned());