Most of the browsers supports the X-XSS-Protection header to prevent XSS atatcks. How we can enable this header in a ASP.Net MVC application?
Do we need to enable it in the application or do we need to do some configuration in the IIS?
-
1See here: stackoverflow.com/questions/4635403/… (Answers explicitly refer to ASP.Net.) – Arminius Jan 20 '17 at 5:53
-
Just don't rely on that header as your only protection in XSS - it is not perfect in all situations. But it can still be good in some situations. Also, in IE8 (and possibly others, don't remember) it can actually introduce vulnerabilities so you might want to check the user agent before you add the header. – Anders Jan 20 '17 at 8:46
If your Web app is an ASP.Net MVC application , it is very easy to enable using the web.config file. All you need to do is add a Custom Header as in the following config entry.
<httpProtocol>
<customHeaders>
<remove name="X-Powered-By" />
<add name="X-XSS-Protection" value="1; mode=block" />
</customHeaders>
</httpProtocol>
It is always better if you can cconfigure the IIS Response header section as well.
-
Corrected tagging <remove name="X-Powered-By" /> <add name="X-XSS-Protection" value="1; mode=block" /> otherwise it shows error. – ABB Sep 14 '17 at 6:53
