Content security policy does not work in Internet Explorer 11

In my main asp.net application, for each response, I add a Content Security Policy header. I understand that for IE the title name X-Content-Security-Policy

and for other browsers like chrome itsContent-Security-Policy

The header value looks something like the one below, where it nonce

differs for each response.

default-src 'none';   
script-src 'self' 'nonce-somerandomvalue-differnt-foreach-reasone' 'unsafe-eval';  
style-src 'self' 'unsafe-inline';   
img-src 'self' data:;   
font-src 'self';    
object-src 'self';   
connect-src 'self';   
report-uri /csp/report;   

      

        
        
        
      

    

The app uses inline javascript across multiple pages. So to fix the inline-script violation, I add the same value nonce

to the script tag.
<script type="text/javascript" nonce="somerandomvalue-differnt-foreach-reasone">


The important value here is the nonce value, which must match the nonce value in the header. some details here

I have implemented a middleware and a helper tag that adds a nonce to the header and script tag respectively. And I made sure both values nonce

match when the page is rendered.

Then, to test the target on the page, I added a script without a nonce

<script type="text/javascript">
    $(function () {
        alert('i am hacker');
    })
</script>

      

        
        
        
      

    

Google chrome detects this violation and blocks the above script as expected. However, in IE 11, the above script is executed without any disruption. Again, I made sure the title in IEX-Content-Security-Policy

Why is IE 11 not blocking the script?