hard20 pts · first answer countsweb-securitycontent-security-policy
A CSP that stops injected scripts
You want a Content Security Policy that blocks scripts injected by an XSS bug but still allows your own inline bootstrap script. Which script-src is the strongest choice?
Discussion 0
Join free to post in the discussion.
Related questions
- Fixing a CORS errorFrontend Developer
- Where to keep a session tokenFrontend Developer
- Secret key with NEXT_PUBLIC_ prefixFrontend Developer
- Preventing XSS from user HTMLFrontend Developer
- CSRF risk left with SameSite=LaxFrontend Developer
- Unsafe postMessage listenerFrontend Developer
- Browser blocks a call that curl allowsBackend Developer
- What HttpOnly does on a cookieBackend Developer