Web Security · Senior · Question 13 of 75
A policy uses a nonce, but the HTML page is cached by a CDN and served to many users. What's wrong?
- 1Nothing, nonces are designed to be cached
- ✓Correct answer: Every user gets the same nonce, so an attacker can learn it and use it in an injected script
- 3The CDN removes CSP headers automatically
Explanation
Nonces must be unique per response. For cached pages use hash-based CSP or don't cache the HTML.