Web Security · Senior · Question 17 of 75

Why can XSS through `postMessage` happen even on a site with strict CSP?

✓Correct answer: The message handler is trusted code; if it passes the data to a sink like innerHTML or location, CSP's nonce rules don't apply
2Because CSP doesn't apply to iframes
3Because postMessage disables CSP for the page

Explanation

CSP blocks new scripts, not your own code doing something dangerous. Trusted Types catch string-to-sink flows like this.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.