title: 500 error when adding security policy of "upgrade-insecure-requests;" in webserver configuration
body: <p>I am getting a mixed content error on my ASP website, so I am trying to resolve this by adding a security policy in the webserver configuration. However, whenever I add the below line, I am getting a 500 error. Anything I am doing wrong?</p>
  
  <p>I am adding the above line inside my customHeaders. I read that I can have a multiple Content-Security-Policy and I assume it will not be an issue.</p>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>    &lt;customHeaders&gt;
          &lt;add name="X-XSS-Protection" value="1; mode=block" /&gt;
          &lt;!-- Protects against Clickjacking attacks. ref.: http://stackoverflow.com/a/22105445/1233379 --&gt;
          &lt;add name="X-Frame-Options" value="SAMEORIGIN" /&gt;
          &lt;!-- Protects against MIME-type confusion attack. ref.: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers/ --&gt;
          &lt;add name="X-Content-Type-Options" value="nosniff" /&gt;
          &lt;!-- CSP modern XSS directive-based defence, used since 2014. ref.: http://content-security-policy.com/ --&gt;
          &lt;add name="Content-Security-Policy" value="default-src 'self'; connect-src *; font-src * data:; frame-src *; img-src * data:; media-src *; object-src *; script-src * 'unsafe-inline' 'unsafe-eval'; style-src * 'unsafe-inline';" /&gt;
          &lt;!--Fix the mixed content issue. --&gt;
          &lt;add name="Content-Security-Policy" value="upgrade-insecure-requests;"/&gt;
          &lt;!-- Protects against Clickjacking attacks. ref.: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet --&gt;
          &lt;add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" /&gt;
          &lt;!-- Prevents from leaking referrer data over insecure connections. ref.: https://scotthelme.co.uk/a-new-security-header-referrer-policy/ --&gt;
          &lt;add name="Referrer-Policy" value="same-origin" /&gt;
          &lt;!--Feature-Policy is a new header that allows a site to control which features and APIs can be used in the browser. ref.: https://wicg.github.io/feature-policy/ --&gt;
          &lt;add name="Feature-Policy" value="accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment *; usb 'none'" /&gt;
        &lt;/customHeaders&gt;</code></pre>
  </div>
  </div>
  </p>