Most of the browsers supports the X-XSS-Protection header to prevent XSS atatcks. How we can enable this header in a ASP.Net MVC application?
Do we need to enable it in the application or do we need to do some configuration in the IIS?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If your Web app is an ASP.Net MVC application , it is very easy to enable using the web.config file. All you need to do is add a Custom Header as in the following config entry.
<httpProtocol> <customHeaders> <remove name="X-Powered-By" /> <add name="X-XSS-Protection" value="1; mode=block" /> </customHeaders> </httpProtocol>
It is always better if you can cconfigure the IIS Response header section as well.