In my asp.net core application for each response i'm adding content security policy header. I understand that for IE, the header name is X-Content-Security-Policy and for other browsers like chrome its Content-Security-Policy
The header value looks something like below where nonce is different for each response.
default-src 'none';
script-src 'self' 'nonce-somerandomvalue-differnt-foreach-reasone' 'unsafe-eval';
style-src 'self' 'unsafe-inline';
img-src 'self' data:;
font-src 'self';
object-src 'self';
connect-src 'self';
report-uri /csp/report;
The application is using inline javascript on few pages. So to fix inline-script violation i am adding same nonce value in script tag.
<script type="text/javascript" nonce="somerandomvalue-differnt-foreach-reasone">
Important thing here is the nonce value needs to match with the nonce value in header. some details here
I implemented middleware & tag-helper which adds nonce into header & script tag respectively. And i made sure that both nonce values does match when page renders.
Then just for testing purpose on a page i added script without nonce
<script type="text/javascript">
$(function () {
alert('i am hacker');
})
</script>
Google chrome detects this violation and blocks the above script as expected. However in IE 11 above script gets executed without any violation. Again, I made sure the header in IE is X-Content-Security-Policy
Why IE 11 is not blocking script?