JavaScript · Senior · Question 65 of 75
How do CSP nonces allow specific inline scripts?
Content-Security-Policy: script-src 'nonce-r4nd0m'
<script nonce="r4nd0m">...</script>- ✓Correct answer: Only scripts carrying the per-response random nonce run; injected scripts without it are blocked
- 2Nonces encrypt the script
- 3The nonce disables CSP for the whole page
Explanation
The nonce must be unpredictable and regenerated on every response, which makes pages dynamic. 'strict-dynamic' lets trusted scripts load further scripts.