Most of the browsers supports the X-XSS-Protection header to prevent XSS atatcks. How we can enable this header in a ASP.Net MVC application?
Do we need to enable it in the application or do we need to do some configuration in the IIS?
If your Web app is an ASP.Net MVC application , it is very easy to enable using the web.config file. All you need to do is add a Custom Header as in the following config entry.
<httpProtocol> <customHeaders> <remove name="X-Powered-By" /> <add name="X-XSS-Protection" value="1; mode=block" /> </customHeaders> </httpProtocol>
It is always better if you can cconfigure the IIS Response header section as well.