Web Security · Middle · Question 17 of 75
What does object-src 'none' protect against?
- 1Loading JSON with
fetch - 2Loading images in
<img>tags - ✓Correct answer: Plugin content like
<object>and<embed>, which could be used to run code outside other directives
Explanation
It's part of every recommended strict policy, along with base-uri 'none' or 'self'.