Web Security · Senior · Question 19 of 75
Which is the main remaining risk once a strict nonce CSP and Trusted Types are in place?
- ✓Correct answer: Logic bugs that misuse trusted code, data exfiltration without script, and attacks on the server side
- 2None, XSS and all other attacks become impossible
- 3Only CSS that looks slightly different
Explanation
These controls are strong against script injection, but they don't fix authorization bugs, CSRF, open redirects or HTML-only data leaks.