Content Security Policy (CSP) is a security layer that can help you detect and mitigate Cross Site Scripting (XSS) and data injection attacks. If your web application displays and stores custom HTML/CSS from user input, then you most certainly need a good filtering method that will remove any Inline JS (
Browser Support
Browsers that don’t support CSP simply ignore it, defaulting to the standard same-origin policy.
| Header | Chrome | FireFox | Safari | Internet Explorer/Edge |
|---|---|---|---|---|
| Content-Security-Policy (1.0) | 25+ | 23+ | 7+ | – |
| Content-Security-Policy (2.0) | 36+ | 31+ | 10+ | – |
| X-Content-Security-Policy | – | 4.0+ | – | 10+ |
| X-Webkit-CSP | 14+ | – | 6+ | – |
As you can see in this table, CSP have good support for major browsers. More info on caniuse.
