https://nalar.dev/tags/xss/ Recent content in XSS on Nalar Hugo en-us Wed, 16 Sep 2026 00:00:00 +0700 https://nalar.dev/csp-strict-dynamic-shifts-script-trust-from-hosts-to-execution-lineage/ Wed, 16 Sep 2026 00:00:00 +0700 https://nalar.dev/csp-strict-dynamic-shifts-script-trust-from-hosts-to-execution-lineage/ <h1 id="csp-strict-dynamic-shifts-script-trust-from-hosts-to-execution-lineage">CSP Strict-Dynamic Shifts Script Trust From Hosts to Execution Lineage</h1> <p>A page can carry a restrictive script host list and still face a difficult deployment choice when its trusted bootstrap code loads dependencies at runtime. Adding every current script host to <code>script-src</code> keeps policy tied to network locations that can change. Adding <code>'strict-dynamic'</code> takes a different route: in supporting browsers, trust attached to a nonce-bearing or hash-authorized root script can propagate to scripts that root code inserts dynamically.</p>