To ensure the Gantry 5 administrator area functions correctly, your Content Security Policy (CSP) must allow 'unsafe-eval' within the script-src directive. This is required for core administrative tasks including cache clearing, editing functionality, JSON parsing, and various UI interactions.
It is highly recommended to use a Split CSP Policy approach: apply a strict policy to your public-facing frontend, but apply a more permissive policy (including unsafe-eval) specifically to the administrator sections of your site.
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;