Can I use
?

Content Security Policy 1.0

- CR

Mitigate cross-site scripting attacks by only allowing certain sources of script, style, and other resources.

Chrome

  1. ❌ 4 - 13: Not supported
  2. ✅ 14 - 24: Supported
  3. ✅ 25 - 135: Supported
  4. ✅ 136: Supported
  5. ✅ 137 - 139: Supported

Edge

  1. ✅ 12 - 135: Supported
  2. ✅ 136: Supported

Safari

  1. ❌ 3.1 - 5: Not supported
  2. ◐ 5.1: Partial support
  3. ✅ 6 - 6.1: Supported
  4. ✅ 7 - 18.4: Supported
  5. ✅ 18.5: Supported
  6. ✅ TP: Supported

Firefox

  1. ❌ 2 - 3.6: Not supported
  2. ✅ 4 - 22: Supported
  3. ✅ 23 - 137: Supported
  4. ✅ 138: Supported
  5. ✅ 139 - 141: Supported

Opera

  1. ❌ 9 - 12.1: Not supported
  2. ✅ 15 - 116: Supported
  3. ✅ 117: Supported

IE

  1. ❌ 5.5 - 9: Not supported
  2. ◐ 10: Partial support
  3. ◐ 11: Partial support

Chrome for Android

  1. ✅ 136: Supported

Safari on iOS

  1. ❌ 3.2 - 4.3: Not supported
  2. ◐ 5: Partial support
  3. ✅ 6: Supported
  4. ✅ 7 - 18.4: Supported
  5. ✅ 18.5: Supported

Samsung Internet

  1. ✅ 4 - 26: Supported
  2. ✅ 27: Supported

Opera Mini

  1. ❌ all: Not supported

Opera Mobile

  1. ❌ 10 - 12.1: Not supported
  2. ✅ 80: Supported

UC Browser for Android

  1. ✅ 15.5: Supported

Android Browser

  1. ❌ 2.1 - 4.3: Not supported
  2. ✅ 4.4 - 4.4.4: Supported
  3. ✅ 136: Supported

Firefox for Android

  1. ✅ 137: Supported

QQ Browser

  1. ✅ 14.9: Supported

Baidu Browser

  1. ✅ 13.52: Supported

KaiOS Browser

  1. ✅ 2.5: Supported
  2. ✅ 3: Supported

The standard HTTP header is Content-Security-Policy which is used unless otherwise noted.

Resources:
CSP Examples & Quick Reference
MDN Web Docs - Content Security Policy
HTML5Rocks article