Content security policy not working

Question

I am adding to my response header this header:

x-content-security-policy default-src 'none';

I would expect no css or images to be loaded on the page, but everything is loaded. What am I doing wrong?

Answer 1

For Chrome and newer (v. 23 and newer) versions of Firefox:

Content-Security-Policy: default-src 'none'

For Safari:

X-Webkit-CSP: default-src 'none'

For older versions of Firefox (v. 23 and older):

X-Content-Security-Policy: default-src 'none'

Sorry - with IE, only the sandbox policy is recognized, and that only in IE 10 and newer.