How does disabling XSS protection affect my website? What security vulnerabilities does it open? My site requires the header to be used on certain pages, so what can I do to secure the pages with the header? (try-it editor)
Add a comment
|
1 Answer
If you disable XSS protection via header, the attacker will be able to inject victim some code into your site if you use dynamic site with inputs where the risk has not been mitigated another way. You can get more information about XSS attacks on Wikipedia
If you want to mitigate this risk and do not use the header, you must secure every single input by methods like htmlspecialchars($value); (in PHP). More about mitigating XSS on W3Schools
-
1w3fools.com - You should encode on output not encode on input. Validation on input can be used a second line of defence. Check out owasp.org/index.php/… Nov 24, 2015 at 9:15