Post #1971125
2023-07-05 20:49 UTC
This is your yearly reminder to not implement, or use, the so-called X-XSS-Protection header https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection since it causes more harm than good
Replies (5)
-
@florenciocano@infosec.exchange 2023-07-05 21:14
@kaoudis here there is more information about the different security headers and which are recommended and which not https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
-
@j3j5@hachyderm.io 2023-07-05 21:47
@kaoudis oh, wow, thanks, I didn't know about its problems 🤯
-
@jamesarosen@hachyderm.io 2023-07-05 22:12
@kaoudis just last week I removed this from a site I had added it to… in 2014
-
@colincogle@mastodon.social 2023-07-06 01:00
@kaoudis Thanks! Getting rid of it once the cat gets off my laptop.
-
@freddy@social.security.plumbing 2023-07-06 04:38
@kaoudis though at this point, it’s not even supported by any relevant modern browser, making it a no-op.