Is it better to disable X-XSS-Protection header or set the header as X-XSS-Protection: 0?

Question

Because X-XSS-Protection header is now not supported by major browsers I wonder what option is better, to delete this header or to set the header as X-XSS-Protection: 0?

Because browsers do not support this header I think the better option is just to delete it, but OWASP recommends to set the header as X-XSS-Protection: 0, because its use can introduce additional security issues on the client side.

Recommendations from OWASP https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#x-xss-protection-header

And when I check websites like Facebook this header is set like in OWASP recommendation.

I think that this setting can be useful if for example my application is used by very old browsers, but if used by modern browsers this header will be just ignored, so there is no need for using it. Am I right?

Answer 1

It is preferred to explicitly set the X-XSS-Protection header to 0 because of the simple fact that having it explicitly disabled prevents XSS Auditor being enabled (which is enabled by default in older browsers unless specifically disabled). This header has a history of doing harm which is why all the browsers are removing it. There are cases where implementing XSS Auditor can implement cross-site information leaks and there are ways to bypass the Auditor.

The way I see it you have more to gain actively disabling it than not including it, and relying instead on a robust Content Security Policy (CSP) header. Even where older browsers don't support CSP I would still disable X-XSS-Protection just to be sure XSS Auditor is disabled as in some old browsers it is enabled by default as mentioned and may actually degrade the security of an old browser visiting the site.

A good discussion on why the X-XSS-Protection should be explicitly disabled instead of just left out can be found here.