7

X-XSS-Protection is a non-standard but widely used header that instructs browsers to enable or disable their builtin protection against reflected XSS attacks.

Most websites I visit send X-XSS-Protection:1; mode=block or no header at all, which, I think, falls back on the browser's default. On the other hand, Facebook sends X-XSS-Protection: 0, something I've only seen in websites demonstrating the XSS attack.

What could be the reason for this?

Improve this question

1 Answer 1

Reset to default
6

Some years ago, in 2009, Internet Explorer had a really buggy early implementation of the XSS auditor, and it was found that perfectly safe websites could be made vulnerable, ironically, by that mitigation. There have also been a few security articles out there showing how IE8's and Chrome's XSS Auditor could actually be used as an attack vector to implement XSS attacks.

More recently, in 2014, XSS auditors are shown to be still very much bypassable.

Facebook did not trust implementations of XSS auditors in browsers from the beginning, and used X-XSS-Protection: 0 since 2009. This also shows some confidence in their template system (XHP), which should be strict enough to avoid introducing XSS vulnerabilities by default.

Improve this answer
3
  • Hi Michele, thanks for your answer. Do you know of any public documents in which Facebook states their position on X-XSS-Protection?
    – Jacopo Notarstefano
    Nov 4, 2015 at 10:25
  • I can't find any. Maybe you could ask them, or Neal Poole (on Twitter @nealpoole).
    – Michele Spagnuolo
    Nov 4, 2015 at 23:39
  • In fact, Facebook originally had 1; mode=block because they did trust the browsers in the beginning. However, after they got hacked, they changed to 0 which is the only safe value: homakov.blogspot.com/2013/02/…
    – Mikko Rantalainen
    Sep 4, 2019 at 8:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .