I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags would be reflected back in full and execute a javascript alert...simple stuff. I included a basic CSP header:
Content-Security-Policy: default-src 'self'
I assumed this would stop the XSS, due to "CSP solves this problem by banning inline script entirely" https://developers.google.com/web/fundamentals/security/csp/
But, the js alert is still popping. I was able to verify that the header is being returned in the server response as expected. I tested with several up-to-date browsers (chrome, firefox, ie11). I applied the header in iis as follows:
# IIS Web.config
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="Content-Security-Policy" value="default-src 'self';" />
</customHeaders>
</httpProtocol>
</system.webServer>
Is my implementation incorrect, or are my expectations wrong here?