CS Fundamentals Trainer · JavaScript · Security

A response carries Content-Security-Policy: script-src 'self' 'unsafe-inline' 'nonce-r4nd'. Which inline scripts in the page run in…

A response carries `Content-Security-Policy: script-src 'self' 'unsafe-inline' 'nonce-r4nd'`. Which inline scripts in the page run in Chromium?

  1. Both a `<script nonce="r4nd">` block and a plain inline `<script>` block, since `'unsafe-inline'` allows the plain one.
  2. Only the `<script nonce="r4nd">` block, because a nonce in the policy makes the browser ignore `'unsafe-inline'`.
  3. Neither inline block, because `'self'` limits execution to scripts loaded from same-origin URLs.
  4. Both blocks and also inline `onclick` attributes, because `'unsafe-inline'` covers event handlers too.

Difficulty: medium

Answer this question

Related questions