Browser & Web Performance · Middle · Question 60 of 75
Why does CSP with 'unsafe-inline' in script-src provide little XSS protection?
- 1It only works in Firefox
- ✓Correct answer: Injected inline scripts and event handler attributes are allowed to run
- 3It blocks all external scripts, breaking the site
Explanation
Most XSS payloads are inline. Use nonces or hashes so only scripts you put on the page can run.