As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer.
So, if we want to support CSP in our application with all the supported browsers which includes IE, what is the approach that one should follow? Is there any alternative to CSP (X-Content-Security-Policy is already deprecated) for IE?
I observed that Facebook.com uses CSP headers with Chrome but doesn't use any alternative of CSP with IE. I came across the iframe header which can be used in place of CSP but couldn't work out how.