Web Security · Junior · Question 64 of 75

With `Content-Security-Policy: script-src 'self'`, what happens to `<script>alert(1)</script>` written into the page?

1It runs, because inline code belongs to the same origin
2It runs only in Chrome
✓Correct answer: It doesn't run: inline scripts are blocked unless allowed with a nonce, hash or 'unsafe-inline'

Explanation

Blocking inline scripts is what makes CSP useful against XSS. Inline event handlers like onclick are blocked too.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.