Web Security · Senior · Question 14 of 75
Why can a CSP allowing https://cdn.jsdelivr.net be bypassed?
- ✓Correct answer: Anyone can publish a package there, so the attacker can load their own script or an old library with known gadgets
- 2Because browsers ignore domains in CSP
- 3Because CDNs don't support HTTPS
Explanation
Public CDNs and domains with JSONP endpoints make host allowlists unsafe. Pin with SRI or move to nonces with 'strict-dynamic'.