CS Fundamentals Trainer · JavaScript · Security

Under a CSP whose script-src does not contain 'unsafe-inline', which source expressions can allow one specific inline <script> block to run?

Under a CSP whose `script-src` does not contain `'unsafe-inline'`, which source expressions can allow one specific inline `<script>` block to run?

  1. A `'nonce-...'` value that matches the block's `nonce` attribute
  2. `'self'`
  3. A `'sha256-...'` hash of the block's exact contents
  4. `'unsafe-eval'`
  5. `https:`

Difficulty: medium

Answer this question

Related questions