CS Fundamentals Trainer · JavaScript · Security

A server uses a nonce-based CSP. Put the steps for one page view in order, first to last.

  1. The browser parses a `<script>` tag and compares its `nonce` with the policy
  2. The browser runs the script because the values match
  3. The server generates a fresh, unguessable random value for this response
  4. The server sends `Content-Security-Policy: script-src 'nonce-<value>'` in the response headers
  5. The server writes the same value into the `nonce` attribute of each of its `<script>` tags in the body

Difficulty: medium

Answer this question

Related questions