Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header:
X-XSS-Protection: 1; mode=block
As I understand it, it prevents reflected XSS attacks by checking that the document does not contain any fishy looking parts of the query string as it loades. For a modern SPA this is not very useful. The HTML loaded directly from the server is often just static, and all the interesting stuff happends after the page has loaded.
Are there any browsers that have XSS filters that also prevents DOM based XSS? A filter like that would for instance check that something passed to .innerHTML
is not a malicious reflection from the query string or any other user input, like a textbox.
Is this a thing? Do I have anything to gain from enabling the XSS filter on a SPA?