DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Web Security Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
Web Security
In the Try It scenario, why does script-src 'self' 'unsafe-inline' fail to block an injected inline <script> tag?
A
'self' doesn't work correctly in modern browsers
B
'unsafe-inline' explicitly re-permits inline script execution, which is exactly the sink the injected payload uses
C
The policy syntax is invalid
D
CSP cannot ever block inline scripts under any configuration
Check Answer