4

Most of the browsers supports the X-XSS-Protection header to prevent XSS atatcks. How we can enable this header in a ASP.Net MVC application?

Do we need to enable it in the application or do we need to do some configuration in the IIS?

Improve this question
2
  • 1
    See here: stackoverflow.com/questions/4635403/… (Answers explicitly refer to ASP.Net.)
    – Arminius
    Jan 20, 2017 at 5:53
  • Just don't rely on that header as your only protection in XSS - it is not perfect in all situations. But it can still be good in some situations. Also, in IE8 (and possibly others, don't remember) it can actually introduce vulnerabilities so you might want to check the user agent before you add the header.
    – Anders
    Jan 20, 2017 at 8:46

1 Answer 1

Reset to default
10

If your Web app is an ASP.Net MVC application , it is very easy to enable using the web.config file. All you need to do is add a Custom Header as in the following config entry.

<httpProtocol>
    <customHeaders>
        <remove name="X-Powered-By" />
        <add name="X-XSS-Protection" value="1; mode=block" />
   </customHeaders>
</httpProtocol>

It is always better if you can cconfigure the IIS Response header section as well.

enter image description here

Improve this answer
2
  • Corrected tagging <remove name="X-Powered-By" /> <add name="X-XSS-Protection" value="1; mode=block" /> otherwise it shows error.
    – ABB
    Sep 14, 2017 at 6:53
  • In my case, I have to place it within <system.webserver> tag.
    – gamal
    Dec 27, 2021 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.