Web Security · Middle · Question 13 of 75
How does a nonce-based CSP work?
- 1The browser generates a nonce and sends it to the server
- 2The nonce is a fixed string stored in the code and reused for every page
- ✓Correct answer: The server generates a random value per response and adds it to the header and to each allowed
<script nonce>
Explanation
An injected script doesn't know this response's nonce, so it's blocked. A nonce that never changes gives no protection.