playframework/playframework — pull request #2674 by mkurz (2014-04-15 12:27:40+00:00)
Title: Removed "X-"Content-Security-Policy header - it's a mess

The `X-Content-Security-Policy` header (with the preceding "`X-`") is a total mess and we shouldn't support this non-standard header in play.

What's wrong with the header?
It **only** [targets IE 10 & 11](http://caniuse.com/#feat=contentsecuritypolicy) and it these browsers do **not** adhere to the standards at all. The only directive for the Content-Security-Policy these browsers support is `sandbox` ([see my pull request for caniuse.com with all it's references](https://github.com/Fyrd/caniuse/pull/512)), all others are ignored. These means the current implementation in play has no effect at all, because we set the header to `default-src 'self'` right now, which, as I said, would get ignored by these browsers and therefore makes no sense at all.

So if on IE 10 & 11 only the `sandbox` directive is supported, why we just don't use this one as the default for the header?
Because it completely differs from the `default-src 'self'` directive behaviour which we apply by default for the standard conform `Content-Security-Policy` header which is supported by all other mature browsers (Firefox, Chrome, Safari). By default `sandbox` does not allow **any** javascript execution at all (doesn't matter if inline or not), does not allow form submits, does not allow xhr requests on the same domain and does not allow popups - whereas the `default-src 'self'` does allow all this by default (except inline script execution). So if we want to have kind of the same result for these headers, we would have to apply the header: `X-Content-Security-Policy: sandbox allow-forms allow-same-origin allow-scripts allow-popups`, which then would make the sandbox directive completly obsolete because we would enable all restriction anyway!
Plus on the other hand, like it is right now, people may expect the same behaviour for all browsers when setting `play.filters.headers.contentSecurityPolicy` in the config (which right now get applied for both headers), which is just not true.

IMHO if someone knows what he is doing and want's to target IE 10 & 11 by using the faulty `X-Content-Security-Policy: sandbox`, it should be done in the users' code, but not by default in play.