Page output · Question 9 of 12
The site uses a Content Security Policy. A template contains a small inline script that the browser blocks. How do you allow it specifically?
1 answer is correct. Medium
Show answer
Answer
- B <script nonce="{f:security.nonce(directive: 'script-src')}">…</script>
Explanation
f:security.nonce returns the nonce of the current request, which TYPO3 writes into the CSP header, so the browser executes exactly this script. unsafe-inline would allow every inline script and thus defeat the protection against injected code. f:format.raw only changes the escaping and has nothing to do with CSP.