[Bug]: Storybook angular eval CSP problem when deployed

[Obentaala141]

Describe the bug

When deploying our Storybook for Angular to a public environment with a strict Content Security Policy (CSP), stories fail to render. The console shows an EvalError indicating that Angular’s JIT compiler is attempting to use eval

any solution guys ? i tried storybook 7 , 8 and 9 .

Reproduction link

.

Reproduction steps

No response

System

.

Additional context

No response

[dosubot]

Hi @Obentaala141! I'm Dosu and I’m helping the storybook team.

Storybook Angular currently relies on Angular's JIT compiler, which uses eval or new Function for runtime template compilation. This is blocked by strict Content Security Policies that disallow unsafe-eval, causing stories to fail to render in such environments. There is no configuration or option in Storybook Angular to enable AOT (Ahead-of-Time) compilation or disable JIT for stories, so this limitation affects all recent Storybook versions (source).

Workarounds like extracting inline scripts or using CSP hashes do not resolve the Angular JIT eval problem, since the core issue is runtime template compilation requiring eval (source). Community discussions confirm this is a current limitation (source). For now, the only practical options are to run Storybook in a less restrictive environment or host documentation outside Storybook.

If you need to comply with strict CSP, you may want to monitor Storybook and Angular changelogs for future updates regarding AOT support or CSP compatibility. If you have a minimal reproduction or workaround you’ve tried, please share it for further investigation.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}