Senior LevelHTML & Semantic Web
How do CSP nonces and cryptographic hashes secure inline script execution?
❓ Interview Prompt: Explain Content Security Policy nonces (nonce-"random-base64"), script hashes ('sha256-...'), and eliminating 'unsafe-inline'.
Allowing 'unsafe-inline' in a Content Security Policy weakens XSS protections. To allow specific legitimate inline scripts safely, use CSP Nonces or Cryptographic Hashes:
1. CSP Nonces:
Server generates a cryptographically random single-use token (nonce) per request ('nonce-rAnd0m123'). Script tag must include matching 'nonce' attribute.
2. Script Hashes:
Calculate the SHA-256 hash of the exact inline script content and include it in the CSP header ('script-src 'sha256-abc123...'').
Code Implementation Example
html
<!-- Script executes ONLY if nonce matches HTTP CSP header -->
<script nonce="rAnd0m12345">
console.log('Authorized inline script');
</script>💡Executing secure inline script via cryptographic CSP nonce attribute.
🎯 Interview Key Takeaway
Use cryptographically random CSP nonces or script SHA hashes to permit specific inline scripts without unsafe-inline.
#CSP Nonce#XSS Security#Hashes#Senior
Back to all HTML & Semantic Web Questions→