Day 20 10 min
Server-side request forgery
1 / 11 · ≈ 9 min left
Warm-up
From yesterday. Answer from memory: a wrong guess still helps you remember.
A page sends script-src 'nonce-k3J9' 'unsafe-inline'. An attacker injects <script>steal()</script> without a nonce. What does a current browser do?