Web Security · Middle · Question 15 of 75

What does `'strict-dynamic'` do in `script-src`?

✓Correct answer: Scripts loaded by an already trusted (nonced) script are trusted too, and host allowlists are ignored
2It allows eval in strict mode only
3It blocks all dynamically created scripts

Explanation

This makes strict CSP practical with bundlers and loaders that add scripts at runtime, without long domain lists.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.