Web Security · Middle · Question 16 of 75
Why is a CSP like script-src 'self' https://cdn.example.com https://www.google.com considered weak?
- 1Because CSP doesn't support more than one host
- ✓Correct answer: Allowlisted hosts often serve JSONP endpoints or old libraries that attackers can use to run code
- 3Because Google domains are blocked by CSP
Explanation
Research showed most allowlist policies can be bypassed this way. Nonces or hashes with 'strict-dynamic' are the recommended approach.