How is it possible to block reflected XSS on common web servers, such as IIS, Apache HTTP Server and Nginx?

The Content-Security-Policy: reflected-xss filter doesn't work on latest Chrome and X-XSS-Protection was removed from latest Chrome.

The question is specifically about these web servers settings, without any code change or WAF.

1 Answer 1


These headers never blocked XSS at the web servers but instead instructed the browsers to use heuristics to detect XSS on the client side.

There is no magic way to block reflected XSS on the server side. And there is no "Without any code change / WAF", at least if you are having a broken application affected by reflected XSS in the first place.

One can use heuristics to filter for common XSS attacks, i.e. use a WAF. Better yet, the code should have proper input validation and output sanitation and should be structured so that a strict Content-Security-Policy (especially no inline eval) can be enforced and will then also be set by the server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .