Browser & Web Performance · Middle · Question 61 of 75

How does a nonce-based CSP decide which inline scripts may run?

Content-Security-Policy: script-src 'nonce-r4nd0m'
<script nonce="r4nd0m">init()</script>

1Scripts run if their content matches the nonce string
✓Correct answer: Only scripts with the random nonce from this response's header run; the nonce must be new on every response
3All inline scripts run once the nonce is set on any script

Explanation

An attacker can't guess a fresh random nonce. Reusing the same nonce across responses defeats the protection.

Further reading

Test yourself

Take the Browser & Web Performance · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.