{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/3770","repository_url":"https://api.github.com/repos/spring-projects/spring-security","labels_url":"https://api.github.com/repos/spring-projects/spring-security/issues/3770/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security/issues/3770/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security/issues/3770/events","html_url":"https://github.com/spring-projects/spring-security/issues/3770","id":143199808,"number":3770,"title":"New Content Security Policy Header does not respect IE 10/11 behaviour","user":{"login":"jgoldhammer","id":3872101,"avatar_url":"https://avatars.githubusercontent.com/u/3872101?v=3","gravatar_id":"","url":"https://api.github.com/users/jgoldhammer","html_url":"https://github.com/jgoldhammer","followers_url":"https://api.github.com/users/jgoldhammer/followers","following_url":"https://api.github.com/users/jgoldhammer/following{/other_user}","gists_url":"https://api.github.com/users/jgoldhammer/gists{/gist_id}","starred_url":"https://api.github.com/users/jgoldhammer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgoldhammer/subscriptions","organizations_url":"https://api.github.com/users/jgoldhammer/orgs","repos_url":"https://api.github.com/users/jgoldhammer/repos","events_url":"https://api.github.com/users/jgoldhammer/events{/privacy}","received_events_url":"https://api.github.com/users/jgoldhammer/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-security/labels/Improvement","name":"Improvement","color":"eeeeee"},{"url":"https://api.github.com/repos/spring-projects/spring-security/labels/Web","name":"Web","color":"000000"}],"state":"open","locked":false,"assignee":{"login":"jgrandja","id":10884212,"avatar_url":"https://avatars.githubusercontent.com/u/10884212?v=3","gravatar_id":"","url":"https://api.github.com/users/jgrandja","html_url":"https://github.com/jgrandja","followers_url":"https://api.github.com/users/jgrandja/followers","following_url":"https://api.github.com/users/jgrandja/following{/other_user}","gists_url":"https://api.github.com/users/jgrandja/gists{/gist_id}","starred_url":"https://api.github.com/users/jgrandja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgrandja/subscriptions","organizations_url":"https://api.github.com/users/jgrandja/orgs","repos_url":"https://api.github.com/users/jgrandja/repos","events_url":"https://api.github.com/users/jgrandja/events{/privacy}","received_events_url":"https://api.github.com/users/jgrandja/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/spring-projects/spring-security/milestones/84","html_url":"https://github.com/spring-projects/spring-security/milestones/4.1.0","labels_url":"https://api.github.com/repos/spring-projects/spring-security/milestones/84/labels","id":1658356,"number":84,"title":"4.1.0","description":"","creator":{"login":"rwinch","id":362503,"avatar_url":"https://avatars.githubusercontent.com/u/362503?v=3","gravatar_id":"","url":"https://api.github.com/users/rwinch","html_url":"https://github.com/rwinch","followers_url":"https://api.github.com/users/rwinch/followers","following_url":"https://api.github.com/users/rwinch/following{/other_user}","gists_url":"https://api.github.com/users/rwinch/gists{/gist_id}","starred_url":"https://api.github.com/users/rwinch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rwinch/subscriptions","organizations_url":"https://api.github.com/users/rwinch/orgs","repos_url":"https://api.github.com/users/rwinch/repos","events_url":"https://api.github.com/users/rwinch/events{/privacy}","received_events_url":"https://api.github.com/users/rwinch/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":2,"state":"open","created_at":"2016-03-21T20:10:11Z","updated_at":"2016-03-25T14:47:16Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2016-03-24T09:43:24Z","updated_at":"2016-03-25T17:07:39Z","closed_at":null,"body":"I am using Spring Security 4.0 in a bigger project and have written my own Content Security Policy Header Writer which writes different header values depending on the user agent delivered in the http request. \r\n\r\nI am using https://github.com/HaraldWalker/user-agent-utils to detect the browser and version.\r\nFor Example, for IE10/11 only X-Content-Security-Policy with the sandbox attribute are allowed to use...\r\n\r\nReference Spring Security 4.1:\r\nhttps://github.com/spring-projects/spring-security/blob/bf9a837b9a3c936fa3c0485f3f3b84231a748ec9/web/src/main/java/org/springframework/security/web/header/writers/ContentSecurityPolicyHeaderWriter.java#L103\r\n\r\nDo you think it is worth to make a pull request?"},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/comments/201368329","html_url":"https://github.com/spring-projects/spring-security/issues/3770#issuecomment-201368329","issue_url":"https://api.github.com/repos/spring-projects/spring-security/issues/3770","id":201368329,"user":{"login":"jgrandja","id":10884212,"avatar_url":"https://avatars.githubusercontent.com/u/10884212?v=3","gravatar_id":"","url":"https://api.github.com/users/jgrandja","html_url":"https://github.com/jgrandja","followers_url":"https://api.github.com/users/jgrandja/followers","following_url":"https://api.github.com/users/jgrandja/following{/other_user}","gists_url":"https://api.github.com/users/jgrandja/gists{/gist_id}","starred_url":"https://api.github.com/users/jgrandja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgrandja/subscriptions","organizations_url":"https://api.github.com/users/jgrandja/orgs","repos_url":"https://api.github.com/users/jgrandja/repos","events_url":"https://api.github.com/users/jgrandja/events{/privacy}","received_events_url":"https://api.github.com/users/jgrandja/received_events","type":"User","site_admin":false},"created_at":"2016-03-25T17:07:39Z","updated_at":"2016-03-25T17:07:39Z","body":"@jgoldhammer I have to apologize as I misread your initial comment. I thought you were referring to the new standard header name proposed by the W3C _Content-Security-Policy_. However, you were actually referring to the deprecated, experimental header _X-Content-Security-Policy_ that is supported by IE 10/11.\r\nNo worries, as @rwinch has already mentioned, we will update the latest release to also include the _X-Content-Security-Policy_ header as well.\r\nThanks for pointing that out!\r\n"}}