THE WORLD'S LARGEST WEB DEVELOPER SITE

AngularJS ng-csp Directive


Example

Change the way AngularJS behaves regarding "eval" and inline styles:

<body ng-app="" ng-csp>
...
Try it Yourself »

Definition and Usage

The ng-csp directive is used to change the security policy of AngularJS.

With the ng-csp directive set, AngularJS will not run any eval functions, and it will not inject any inline styles.

Setting the value of the ng-csp directive to no-unsafe-eval, will stop AngularJS from running any eval functions, but allow injecting inline styles.

Setting the value of the ng-csp directive to no-inline-style, will stop AngularJS from injecting any inline styles, but allow eval functions.

Using the ng-csp directive is necessary when developing apps for Google Chrome Extensions or Windows Apps.

Note: The ng-csp directive does not affect JavaScript, but it changes the way AngularJS works, meaning: you can still write eval functions, and they will be executed as you expect, but AngularJS will not run its own eval functions. It uses a compatibility mode which can slow down the evaluation time up to 30%.


Syntax

<element ng-csp="no-unsafe-eval | no-inline-style"></element>

Parameter Values

Value Description
no-unsafe-eval
no-inline-style
The value can be empty, meaning neither eval or inline styles are allowed.
The value can be one of the two values described.
The value can be both values, separated by a semicolon, but that will have the same meaning as an empty value.