As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer.

So, if we want to support CSP in our application with all the supported browsers which includes IE, what is the approach that one should follow? Is there any alternative to CSP (X-Content-Security-Policy is already deprecated) for IE?

I observed that Facebook.com uses CSP headers with Chrome but doesn't use any alternative of CSP with IE. I came across the iframe header which can be used in place of CSP but couldn't work out how.

1 Answer 1


MDN - Content Security Policy (CSP) - Browser Compatibility shows what is supported in MSIE and what not. To summarize:

  • MSIE only supports the sandbox flag
  • MSIE only supports the old X-Content-Security-Policy header. It does not matter if it is deprecated - MSIE by itself is deprecated too.

Is there any alternative to CSP

There is no general alternative to CSP. Some parts of what is know in CSP can be achieved with X-Frame-Options but most of the functionality of CSP is simply not available in MSIE.

  • X-XSS-Protection also helps achieve in older versions of IE some of what CSP does. May 16, 2019 at 20:25
  • @CameronGagnon: There is no overlap in functionality between CSP and X-XSS-Protection. X-XSS-Protection deals with the built-in heuristics to detect XSS while CSP provides an explicit policy when and where script is allowed - and also can policy much more than just the usage of script. The only common thing is that they both can help to mitigate XSS. But since X-XSS-Protection is only a heuristics is has both false positives (blocks valid things) and false negatives (does not find all XSS). May 17, 2019 at 1:29
  • thank you for that clarification. I guess I should've phrased it that X-XSS-Protection is another means to help mitigate XSS in older versions of IE where CSP doesn't exist. Both of their goals is to prevent XSS, however they go about it in different ways. May 18, 2019 at 2:28
  • @CameronGagnon: Heuristics to detect reflected XSS (like the ones controlled by X-XSS-Protection) do actually exist in modern browsers in addition to CSP. " Both of their goals is to prevent XSS..." - prevention of reflected XSS is only one goal of CSP, it does more than that. Another part of what CSP does is also covered by X-Frame-Options which is also available in IE. But even both options together cover only a part of what CSP does. May 18, 2019 at 6:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .