Browser & Web Performance · Senior · Question 45 of 75

Why are host-allowlist CSPs like `script-src 'self' https://cdn.example.com` often bypassable?

1Browsers ignore host lists in CSP
2Host lists only apply to images
✓Correct answer: Allowed hosts may serve JSONP endpoints or old libraries with script gadgets an attacker can use to run code

Explanation

Research found most allowlist-based policies could be bypassed. Nonce or hash-based strict CSP avoids this.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.