Web Security · Senior · Question 15 of 75

What does `require-trusted-types-for 'script'` actually enforce?

1Every <script> tag must have a nonce
✓Correct answer: Injection sinks like innerHTML, eval and script.src throw if given a plain string instead of a Trusted Type
3Scripts must be loaded with type="module"

Explanation

A default policy can be defined as a migration aid, but it should sanitize or reject, not pass everything through.

Further reading

MDN: Trusted Types API ↗

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.