Web Security · Junior · Question 67 of 75

Why does adding `'unsafe-inline'` to `script-src` weaken CSP so much?

✓Correct answer: It allows any inline script, which is exactly what most XSS payloads are
2It makes the page load more slowly
3It disables HTTPS on the page

Explanation

With 'unsafe-inline' an injected <script> or onerror handler runs again. Nonces or hashes allow your own inline code without opening that door.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.