X-XSS-Protection Header is Set

Description

The HTTP X-XSS-Protection response header, originally designed for Internet Explorer, Chrome, and Safari, aimed to mitigate reflected cross-site scripting (XSS) attacks. However, its effectiveness has diminished due to changes in browser behavior. Chrome has removed its XSS Auditor, Firefox does not and will not implement X-XSS-Protection, and Edge has retired its XSS filter. As a result, it is no longer recommended to rely solely on this header for XSS protection.

Recommendation

To enhance XSS protection, it is recommended not to send the X-XSS-Protection header or explicitly set its value to 0. Instead, use a modern Content Security Policy (CSP) without allowing unsafe-inline scripts, which provides more robust protection against XSS attacks.

References

• CWE-16
• Mozilla: Web Security
• Mozilla: X-XSS-Protection
• OWASP 2021-A5
• OWASP github: Remove X-XSS-Protection Response Header
• OWASP: Content Security Policy (CSP)