FrontendHaltSecurity·Advanced·Conceptual·1 min read
What does 'strict-dynamic' do in a CSP?
Short interview answer
It propagates trust from a script that already passed the nonce or hash check to scripts that script loads dynamically, so trusted code can pull in its own dependencies without every CDN being allowlisted. It effectively replaces host-based rules with propagated trust.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.