title: Content Security Policy does not work in Internet Explorer 11
body: <p>In my asp.net core application for each response i'm adding content security policy header. I understand that for IE, the header name is <code>X-Content-Security-Policy</code> and for other browsers like chrome its <code>Content-Security-Policy</code></p>
  
  <p>The header value looks something like below where <code>nonce</code> is different for each response.</p>
  
  <pre><code>default-src 'none';   
  script-src 'self' 'nonce-somerandomvalue-differnt-foreach-reasone' 'unsafe-eval';  
  style-src 'self' 'unsafe-inline';   
  img-src 'self' data:;   
  font-src 'self';    
  object-src 'self';   
  connect-src 'self';   
  report-uri /csp/report;   
  </code></pre>
  
  <p>The application is using inline javascript on few pages. So to fix inline-script violation i am adding same <code>nonce</code> value in script tag.<br>
  <code>&lt;script type="text/javascript" nonce="somerandomvalue-differnt-foreach-reasone"&gt;</code><br>
  Important thing here is the nonce value needs to match with the nonce value in header. <a href="http://www.cspplayground.com/compliant_examples" rel="noreferrer">some details here</a></p>
  
  <p>I implemented middleware &amp; tag-helper which adds nonce into header &amp; script tag respectively. And i made sure that both <code>nonce</code> values does match when page renders.</p>
  
  <p>Then just for testing purpose on a page i added script <strong>without nonce</strong></p>
  
  <pre><code>&lt;script type="text/javascript"&gt;
      $(function () {
          alert('i am hacker');
      })
  &lt;/script&gt;
  </code></pre>
  
  <p>Google chrome detects this violation and blocks the above script as expected. However in IE 11 above script gets executed without any violation. Again, I made sure the header in IE is <code>X-Content-Security-Policy</code></p>
  
  <p>Why IE 11 is not blocking script?</p>