Learn the vocabulary of restricting which sources a browser is allowed to load a script or resource from.
0 / 5 completed
1 / 5
At standup, a dev mentions a response header that tells the browser exactly which sources scripts, styles, and other resources are allowed to load from, blocking anything outside that allowlist. What is this header called?
A Content Security Policy, or CSP, is a response header that tells the browser exactly which sources scripts, styles, and other resources are allowed to load from, blocking anything outside that allowlist. The Content-Type header only tells the browser how to interpret the response body, which is an entirely different purpose from restricting resource origins. This source restriction is what makes CSP an effective defense against a malicious script being injected and executed from an untrusted origin.
2 / 5
During a design review, the team wants to allow one specific inline script to execute while still blocking any other injected inline script an attacker might insert. Which capability supports this?
A nonce-based script-src directive allowlists only a script tagged with a matching, randomly generated nonce value, so a legitimate inline script executes while an injected script, which won't have that nonce, is blocked. A script-src directive permitting unsafe-inline lets every inline script execute, including one an attacker managed to inject, which defeats the purpose of having a CSP at all. This nonce-based allowlisting is what lets a page keep some inline scripts while still meaningfully restricting which ones can run.
3 / 5
In a code review, a dev notices the CSP header is initially deployed with report-uri set and Content-Security-Policy-Report-Only used instead of the enforcing header, so violations are observed without actually blocking anything yet. What does this represent?
Report-only mode lets the team observe what a new CSP would have blocked, via a violation report, without actually enforcing that blocking yet, catching a policy that's too strict or missing an allowed source before it breaks real functionality. Deploying the enforcing header directly, with no report-only validation, risks breaking a legitimate resource the policy didn't anticipate. This staged rollout is a standard way to introduce a CSP safely on an existing, already-complex page.
4 / 5
An incident report shows an attacker successfully executed an injected script that stole session cookies, because the page served no Content-Security-Policy header at all, leaving the browser with no restriction on which script sources it would execute. What practice would prevent this?
Deploying a Content Security Policy that restricts script sources to a trusted allowlist blocks an injected script from executing, since it won't come from, or carry the nonce or hash of, a source the policy actually trusts. Serving no CSP header at all is exactly what left the browser free to execute the attacker's injected script in this incident. This restriction is one of the most effective, broadly applicable defenses against a cross-site scripting attack succeeding even after malicious content has been injected into a page.
5 / 5
During a PR review, a teammate asks why the team uses a nonce-based CSP allowlist instead of just permitting unsafe-inline so every existing inline script keeps working without modification. What is the reasoning?
Permitting unsafe-inline lets any injected script execute just as freely as a legitimate one, since the directive draws no distinction between the two at all. A nonce-based allowlist blocks an injected script that lacks the matching, unpredictable nonce, while still letting the page's own legitimate inline scripts run. The tradeoff is the added build-time or server-side work needed to generate and inject a fresh nonce into every legitimate inline script on each page render.
What does the "Content Security Policy Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to content security policy vocabulary through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 11 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.