Read this CSP: four policies, which one actually stops an XSS?
Four Content-Security-Policy headers that all look strict. Predict what each one really permits before you read the answers, then paste any of them into the CSP builder to confirm.
Topic
Try it
It looks strict. It permits everything. Which is which?Try it
More on Try it
Your fingers type lodahs. The install script runs anyway.Try it
Five headers. Two are real. Score yourself before you scroll.Try it
Three of these four tell you how to forge them. Can you see it?Try it
← All posts
Spot the typosquat: eight package names, which one is fake?
Eight install commands, each with one impostor package name hidden among the real ones. Train the instinct that reads a dependency name twice, because the install script runs before any of your code does.
Spot the phish: five emails, two are genuine
Five sets of real-looking mail headers. Decide which are forged before you read the answers, then paste any of them into the phishing email analyzer to see what it would have told you.
Read this JWT: four tokens, which one would you trust?
Four JSON Web Tokens, three with a weakness you can see from the header and payload alone. Spot each flaw before the answers, then paste any token into the JWT inspector to confirm — and read the one-line server fix for each.