Trying add a custom header "Content Security Policy" to the IIS to mitigate the risk of content injection vulnerabilities such as cross-site scripting. When adding e-junkie as an allowed script to run on my server the cart links now opens up into a new browser window instead of the normal popup overlay. Any insight would be appreciated.
<httpProtocol>
<customHeaders>
<clear />
<add name="X-Frame-Options" value="sameorigin" />
<add name="X-Content-Type-Options" value="nosniff" />
<add name="X-XSS-Protection" value="1; mode=block" />
<add name="Content-Security-Policy" value="script-src 'self' *.e-junkie.com *.unpkg.com *.fatfreecartpro.com;" />
</customHeaders>
<httpProtocol>
