Web Security · Middle · Question 18 of 75
Why should a strict CSP include base-uri 'none' (or 'self')?
- ✓Correct answer: An injected
<base href>could make relative script URLs load from the attacker's server - 2Because without it, images don't load
- 3It controls which language the page uses
Explanation
A <base> tag changes how every relative URL resolves. Restricting it closes a bypass even when nonces are in place.