Content security policy blocks everything on iOS Safari v5.1.1 about nelmiosecuritybundle HOT 5 CLOSED

There is no way to do this per device no. We can't really control how browsers implement the spec and how buggy they are though, so I'm afraid this can't be fixed. What I'll do though is add a config flag to let people send only the standard Content-Security-Policy header and not the old X- and Webkit- prefixed ones. That should effectively exclude older browsers with possibly buggy implementations. Not very nice but better than breaking the site entirely for those users I guess.

from nelmiosecuritybundle.

According to http://michael-coates.blogspot.com/2013/09/security-capabilities-comparison-hsts.html only IE10/11 won't be covered by the standard header, other older browsers IMO are an acceptable loss. That said enabling CSP is pretty beneficial even if you don't cover all browsers, especially with reporting it allows you to fix any issue as soon as a Chrome/Firefox/Opera/Safari user hits the site. Up to you though :)

from nelmiosecuritybundle.

Thanks, @Seldaek. I appreciate you taking a look into this. I have also heard to stay away from the older headers, so this fix works out well.

from nelmiosecuritybundle.

It's tagged in 1.4.0 now by the way.

from nelmiosecuritybundle.

Got it, I just updated. Thank you for updating the documentation to match. Made it really easy to switch over.

from nelmiosecuritybundle.