CS Fundamentals Trainer · JavaScript · Security

A page is served with Content-Security-Policy: script-src 'nonce-r4nd' 'strict-dynamic' https://cdn.example. Which script executes in…

A page is served with `Content-Security-Policy: script-src 'nonce-r4nd' 'strict-dynamic' https://cdn.example`. Which script executes in Chromium?

  1. A `<script src="https://cdn.example/lib.js">` tag in the HTML without a nonce, because its host is in the policy
  2. An inline `onclick="..."` attribute on a button, because `'strict-dynamic'` trusts the page's own markup
  3. A script element that the nonced inline script creates with `document.createElement('script')` and appends
  4. A `<script>` block without a nonce, provided it was part of the original HTML response

Difficulty: hard

Answer this question

Related questions