Edge ignores script-src in Content Security Policy
问题 I have the following Content Security Policy value="default-src 'self' style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://svc.webspellchecker.net; img-src 'self' data: https://s3.amazonaws.com; frame-src 'self' *.salesforce.com *.force.com;" This works fine in Chrome and Firefox. In Edge it is not running because we have some inline scripts (ie onClick="foo() ). My understanding is the the default-src sets the defaults and the script-src should override