X-XSS-Protection header
# help-with-umbraco
a
What's your experience with setting this header? Umbraco/MSDN seems to recommend to removing this header. If I understand correctly, older browsers (which do not support CSP), could use the absence of the X-XSS-Protection header to create an attack. is it better to keep the header, but for example set it to
Sanitize
instead of
Block
?
s
a
But then older browsers can be used to do such an attack right ?
As they do not support CSP yet
https://security.stackexchange.com/questions/253924/is-it-better-to-disable-x-xss-protection-header-or-set-the-header-as-x-xss-prote
Copy code
It is preferred to explicitly set the X-XSS-Protection header to 0 because of the simple fact that having it explicitly disabled prevents XSS Auditor being enabled (which is enabled by default in older browsers unless specifically disabled). This header has a history of doing harm which is why all the browsers are removing it. There are cases where implementing XSS Auditor can implement cross-site information leaks and there are ways to bypass the Auditor.

The way I see it you have more to gain actively disabling it than not including it, and relying instead on a robust Content Security Policy (CSP) header. Even where older browsers don't support CSP I would still disable X-XSS-Protection just to be sure XSS Auditor is disabled as in some old browsers it is enabled by default as mentioned and may actually degrade the security of an old browser visiting the site.
so it seems setting it to 0 explicitly is even better the removing the header
s
It depends on who the site is for, but looking at belastingdienst.nl and rabobank.nl who don't have the header at all, I'd say that they would have extremely strict auditing, so if they don't need it, you probably don't need it.
j
OWASP say either 0 or not set. If someone's using that old a browser then that kind of XSS is the least of their problems.
Its worth bearing in mind that the header simply enables a detection feature for reflected XSS. If your site isn't reflecting, which it really shouldn't be, then whether the browser is capable of detecting it doesn't really matter. https://learn.microsoft.com/en-us/aspnet/core/security/cross-site-scripting?view=aspnetcore-8.0
a
Thanks, clarified it a bit, especially the why part 🙂
23 Views