Content Security Policy 1.0

Mitigate cross-site scripting attacks by whitelisting allowed sources of script, style, and other resources.

Spec	http://www.w3.org/TR/2012/CR-CSP-20121115/
Status	W3C Candidate Recommendation

IE	Edge	Firefox	Chrome	Safari	Opera
		57	62
		56	61	TP	48
	16	55	60	11	47
11 ⁽¹⁾	15	54	59	10.1	46
10 ⁽¹⁾	14	53	58	10	45
9	13	52	57	9.1	44
8	12	51	56	9	43
Show all
7		50	55	8	42
6		49	54	7.1	41
5.5		48	53	7	40
		47	52	6.1 ⁽²⁾	39
		46	51	6 ⁽²⁾	38
		45	50	5.1 ⁽²⁾	37
		44	49	5	36
		43	48	4	35
		42	47	3.2	34
		41	46	3.1	33
		40	45		32
		39	44		31
		38	43		30
		37	42		29
		36	41		28
		35	40		27
		34	39		26
		33	38		25
		32	37		24
		31	36		23
		30	35		22
		29	34		21
		28	33		20
		27	32		19
		26	31		18
		25	30		17
		24	29		16
		23	28		15
		22 ⁽¹⁾	27		12.1
		21 ⁽¹⁾	26		12
		20 ⁽¹⁾	25		11.6
		19 ⁽¹⁾	24 ⁽²⁾		11.5
		18 ⁽¹⁾	23 ⁽²⁾		11.1
		17 ⁽¹⁾	22 ⁽²⁾		11
		16 ⁽¹⁾	21 ⁽²⁾		10.6
		15 ⁽¹⁾	20 ⁽²⁾		10.5
		14 ⁽¹⁾	19 ⁽²⁾		10.0-10.1
		13 ⁽¹⁾	18 ⁽²⁾		9.5-9.6
		12 ⁽¹⁾	17 ⁽²⁾		9
		11 ⁽¹⁾	16 ⁽²⁾
		10 ⁽¹⁾	15 ⁽²⁾
		9 ⁽¹⁾	14 ⁽²⁾
		8 ⁽¹⁾	13
		7 ⁽¹⁾	12
		6 ⁽¹⁾	11
		5 ⁽¹⁾	10
		4 ⁽¹⁾	9
		3.6	8
		3.5	7
		3	6
		2	5
			4

Notes

The standard HTTP header is Content-Security-Policy which is used unless otherwise noted.

Partial support in Internet Explorer 10-11 refers to the browser only supporting the 'sandbox' directive by using the X-Content-Security-Policy header.
Partial support in iOS Safari 5.0-5.1 refers to the browser recognizing the X-Webkit-CSP header but failing to handle complex cases correctly, often resulting in broken pages.
Chrome for iOS fails to render pages without a connect-src 'self' policy.

Data by caniuse.com
Licensed under the Creative Commons Attribution License v4.0.
http://caniuse.com/#feat=contentsecuritypolicy