I am using turnstile : 1.1.13, captcha is working fine, but it shows errors on the console.
The Content Security Policy (CSP) prevents the evaluation of arbitrary strings as JavaScript to make it more difficult for an attacker to inject unathorized code on your site.
To solve this issue, avoid using eval(), new Function(), setTimeout([string], ...) and setInterval([string], ...) for evaluating strings.
If you absolutely must: you can enable string evaluation by adding unsafe-eval as an allowed source in a script-src directive.
⚠️ Allowing string evaluation comes at the risk of inline script injection.
1 directive
Source location Directive Status
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchest... script-src blocked
Please have a look at the attached screenshot:
Active
1.1
User interface
This appears to be an issue with Turnstile, and not the module. We don't use eval(), new Function(), setTimeout([string], ...) and setInterval([string], ...) in the module itself, but it's present in the hosted file from Cloudflare.