7

X-XSS-Protection is a non-standard but widely used header that instructs browsers to enable or disable their builtin protection against reflected XSS attacks.

Most websites I visit send X-XSS-Protection:1; mode=block or no header at all, which, I think, falls back on the browser's default. On the other hand, Facebook sends X-XSS-Protection: 0, something I've only seen in websites demonstrating the XSS attack.

What could be the reason for this?

6

Some years ago, in 2009, Internet Explorer had a really buggy early implementation of the XSS auditor, and it was found that perfectly safe websites could be made vulnerable, ironically, by that mitigation. There have also been a few security articles out there showing how IE8's and Chrome's XSS Auditor could actually be used as an attack vector to implement XSS attacks.

More recently, in 2014, XSS auditors are shown to be still very much bypassable.

Facebook did not trust implementations of XSS auditors in browsers from the beginning, and used X-XSS-Protection: 0 since 2009. This also shows some confidence in their template system (XHP), which should be strict enough to avoid introducing XSS vulnerabilities by default.

  • Hi Michele, thanks for your answer. Do you know of any public documents in which Facebook states their position on X-XSS-Protection? – Jacopo Notarstefano Nov 4 '15 at 10:25
  • I can't find any. Maybe you could ask them, or Neal Poole (on Twitter @nealpoole). – Michele Spagnuolo Nov 4 '15 at 23:39
  • In fact, Facebook originally had 1; mode=block because they did trust the browsers in the beginning. However, after they got hacked, they changed to 0 which is the only safe value: homakov.blogspot.com/2013/02/… – Mikko Rantalainen Sep 4 at 8:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.