Browser & Web Performance · Senior · Question 46 of 75

Why should a strict CSP include `base-uri 'none'` (or `'self'`)?

1It is required for nonces to work
✓Correct answer: An injected <base href> could redirect relative script URLs to an attacker's server
3It speeds up resolving relative URLs

Explanation

Even nonced scripts loaded by relative path would follow the injected base URL.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.