Security/CSP/Spec: Difference between revisions

The <tt>X-Content-Security-Policy</tt> HTTP Response header should be present in the [http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 Message Headers] section of a server's HTTP response.  Specifically, it must NOT appear in the [http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.40 Trailer Headers] section of the response, so that the policy may be enforced as the rest of the page content loads.  Only the first <tt>X-Content-Security-Policy</tt> Response header received by the user agent will be considered; any additional <tt>X-Content-Security-Policy</tt> HTTP Response headers in the same response will be ignored.