Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

X-XSS-Protection header should be absent or set to 0 #5328

Closed
valentijnscholten opened this issue Oct 23, 2021 · 1 comment · Fixed by #5330
Closed

X-XSS-Protection header should be absent or set to 0 #5328

valentijnscholten opened this issue Oct 23, 2021 · 1 comment · Fixed by #5330
Labels
bug

Comments

@valentijnscholten
Copy link
Member

According to the new OWASP HTTP Header Cheat Sheet, we should remove or disable the X-XSS-Protection header.

They don't say why, so I made a PR to add some explanation: OWASP/CheatSheetSeries#769
@valentijnscholten valentijnscholten mentioned this issue Oct 24, 2021
Merged
damiencarol pushed a commit that referenced this issue Oct 25, 2021
@manuel-sommer
remove X-XSS-Protection header (#5330)
58ee3f3 
* remove X-XSS header, resolves #5328

* remove X-XSS header, resolves #5328

Co-authored-by: Manuel Sommer <[email protected]>
@damiencarol damiencarol linked a pull request Oct 25, 2021 that will close this issue
remove X-XSS-Protection header #5330
Merged
@damiencarol
Copy link
Contributor

Fixed in dev

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

remove X-XSS-Protection header
2 participants
@damiencarol @valentijnscholten