Agent Wranglers

APS-36Avoid

Sending the old XSS filter header

Do not turn on X-XSS-Protection. The filter it controls is gone from current browsers, and in old ones it could open holes. Rely on the Content Security Policy instead.

By Agent Wranglers. Updated .

How to do it

Remove the header from the server and from any security middleware defaults. If a scanner insists on the header, send X-XSS-Protection: 0, which turns the old filter off, as OWASP advises. Stop cross-site scripting with escaping and a CSP, as Escape everything you show says.

Examples

nginx example

# Remove any line like this
# add_header X-XSS-Protection "1; mode=block";
proxy_hide_header X-XSS-Protection;

How to check

curl -sI shows no X-XSS-Protection, or shows it with the value 0.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/x-xss-protection">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.