在Internet Explorer上为Angular应用程序实施内容安全策略

Question

We are working on implementation of CSP(Content Security Policy) requirement in our application. We have set the CSP setting through the index.html using the meta tag :

  <meta http-equiv="Content-Security-Policy" content="
  script-src 'self' 'unsafe-inline' 'unsafe-eval'" />

which works fine in Chrome & Firefox. However, we need to implement this for Internet Explorer also.

Answer 1

IE doesn't support CSP. At most you can use the X-Content-Security-Policy for IE 10 and newer. But this only supports the sandbox directive. Edge though should support most of what you need.

Additional info on caniuse