7

As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer.

So, if we want to support CSP in our application with all the supported browsers which includes IE, what is the approach that one should follow? Is there any alternative to CSP (X-Content-Security-Policy is already deprecated) for IE?

I observed that Facebook.com uses CSP headers with Chrome but doesn't use any alternative of CSP with IE. I came across the iframe header which can be used in place of CSP but couldn't work out how.

| improve this question | |
7

MDN - Content Security Policy (CSP) - Browser Compatibility shows what is supported in MSIE and what not. To summarize:

  • MSIE only supports the sandbox flag
  • MSIE only supports the old X-Content-Security-Policy header. It does not matter if it is deprecated - MSIE by itself is deprecated too.

Is there any alternative to CSP

There is no general alternative to CSP. Some parts of what is know in CSP can be achieved with X-Frame-Options but most of the functionality of CSP is simply not available in MSIE.

| improve this answer | |
  • X-XSS-Protection also helps achieve in older versions of IE some of what CSP does. – Cameron Gagnon May 16 '19 at 20:25
  • @CameronGagnon: There is no overlap in functionality between CSP and X-XSS-Protection. X-XSS-Protection deals with the built-in heuristics to detect XSS while CSP provides an explicit policy when and where script is allowed - and also can policy much more than just the usage of script. The only common thing is that they both can help to mitigate XSS. But since X-XSS-Protection is only a heuristics is has both false positives (blocks valid things) and false negatives (does not find all XSS). – Steffen Ullrich May 17 '19 at 1:29
  • thank you for that clarification. I guess I should've phrased it that X-XSS-Protection is another means to help mitigate XSS in older versions of IE where CSP doesn't exist. Both of their goals is to prevent XSS, however they go about it in different ways. – Cameron Gagnon May 18 '19 at 2:28
  • @CameronGagnon: Heuristics to detect reflected XSS (like the ones controlled by X-XSS-Protection) do actually exist in modern browsers in addition to CSP. " Both of their goals is to prevent XSS..." - prevention of reflected XSS is only one goal of CSP, it does more than that. Another part of what CSP does is also covered by X-Frame-Options which is also available in IE. But even both options together cover only a part of what CSP does. – Steffen Ullrich May 18 '19 at 6:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.