Content-Security-Policy: default-src 'self'
I assumed this would stop the XSS, due to "CSP solves this problem by banning inline script entirely" https://developers.google.com/web/fundamentals/security/csp/
But, the js alert is still popping. I was able to verify that the header is being returned in the server response as expected. I tested with several up-to-date browsers (chrome, firefox, ie11). I applied the header in iis as follows:
# IIS Web.config <system.webServer> <httpProtocol> <customHeaders> <add name="Content-Security-Policy" value="default-src 'self';" /> </customHeaders> </httpProtocol> </system.webServer>
Is my implementation incorrect, or are my expectations wrong here?