Browser security
Compatibility & evidence
Content execution

Content Security Policy

Restricts the browser resources and execution paths that a document may use.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari27WorksEvery required mapped BCD feature is available without a recorded qualification.
Chrome for Android155WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari on iOS27WorksEvery required mapped BCD feature is available without a recorded qualification.
Android WebView155WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

http.headers.Content-Security-Policy
  1. 1 – 1313 recorded releases
    Not supported
    • Uses alternative name X-Webkit-CSP
  2. 14 – 2411 recorded releases
    Works with limits
    • Uses alternative name X-Webkit-CSP
  3. 25 – 155130 recorded releases
    Works

Edge

http.headers.Content-Security-Policy
  1. 12 – 132 recorded releases
    Not supported
  2. 14 – 15480 recorded releases
    Works

Firefox

http.headers.Content-Security-Policy
  1. 1 – 3.66 recorded releases
    Not supported
    • Uses alternative name X-Content-Security-Policy
  2. 4 – 2219 recorded releases
    Works with limits
    • Uses alternative name X-Content-Security-Policy
  3. 23 – 157135 recorded releases
    Works

Safari

http.headers.Content-Security-Policy
  1. 1 – 5.110 recorded releases
    Not supported
    • Uses alternative name X-Webkit-CSP
  2. 61 recorded release
    Works with limits
    • Uses alternative name X-Webkit-CSP
  3. 7 – 2750 recorded releases
    Works

Chrome for Android

http.headers.Content-Security-Policy
  1. 181 recorded release
    Works with limits
    • Uses alternative name X-Webkit-CSP
  2. 25 – 155130 recorded releases
    Works

Firefox for Android

http.headers.Content-Security-Policy
  1. 4 – 2216 recorded releases
    Not supported
  2. 23 – 157125 recorded releases
    Works

Safari on iOS

http.headers.Content-Security-Policy
  1. 1 – 57 recorded releases
    Not supported
    • Uses alternative name X-Webkit-CSP
  2. 61 recorded release
    Works with limits
    • Uses alternative name X-Webkit-CSP
  3. 7 – 2750 recorded releases
    Works

Android WebView

http.headers.Content-Security-Policy
  1. 1 – 46 recorded releases
    Not supported
    • Uses alternative name X-Webkit-CSP
  2. 4.4 – 155120 recorded releases
    Works

Samsung Internet

http.headers.Content-Security-Policy
  1. 1.01 recorded release
    Works with limits
    • Uses alternative name X-Webkit-CSP
  2. 1.5 – 30.051 recorded releases
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • Content injection
  • Cross-site scripting
  • Untrusted embedding

Does not guarantee

  • Unsafe application logic already permitted by the policy
  • Server-side injection
  • Complete prevention of browser implementation defects

What you need before using it

  • A policy designed and tested for the application

Fallback to keep in place

Keep output encoding, input handling, dependency review, and other application controls in place.