Browser & Web Performance · Senior · Question 44 of 75

What does `'strict-dynamic'` in a CSP do?

Content-Security-Policy: script-src 'nonce-abc' 'strict-dynamic'; object-src 'none'; base-uri 'none'

1It allows all dynamically created inline event handlers
✓Correct answer: Scripts loaded by an already trusted (nonced) script are also trusted, and host allowlists are ignored
3It enables eval for trusted scripts

Explanation

This makes strict CSP practical with bundlers and loaders, without long, bypassable domain allowlists.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.