What's the alternative of content security policy (CSP) header in Internet Explorer IE?

Question

As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer.

So, if we want to support CSP in our application with all the supported browsers which includes IE, what is the approach that one should follow? Is there any alternative to CSP (X-Content-Security-Policy is already deprecated) for IE?

I observed that Facebook.com uses CSP headers with Chrome but doesn't use any alternative of CSP with IE. I came across the iframe header which can be used in place of CSP but couldn't work out how.

Answer 1

MDN - Content Security Policy (CSP) - Browser Compatibility shows what is supported in MSIE and what not. To summarize:

• MSIE only supports the sandbox flag
• MSIE only supports the old X-Content-Security-Policy header. It does not matter if it is deprecated - MSIE by itself is deprecated too.

Is there any alternative to CSP

There is no general alternative to CSP. Some parts of what is know in CSP can be achieved with X-Frame-Options but most of the functionality of CSP is simply not available in MSIE.