4

Because X-XSS-Protection header is now not supported by major browsers I wonder what option is better, to delete this header or to set the header as X-XSS-Protection: 0?

Screen from https://caniuse.com/?search=x-xss-protection

Because browsers do not support this header I think the better option is just to delete it, but OWASP recommends to set the header as X-XSS-Protection: 0, because its use can introduce additional security issues on the client side.

Recommendations from OWASP https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#x-xss-protection-header

enter image description here

And when I check websites like Facebook this header is set like in OWASP recommendation.

I think that this setting can be useful if for example my application is used by very old browsers, but if used by modern browsers this header will be just ignored, so there is no need for using it. Am I right?

1
  • It's great that you quoted the sources, but do you mind using a text quote instead of a screenshot (second image)? This makes it easier to search for and copy around.
    – Arminius
    Aug 3, 2021 at 15:39

1 Answer 1

4

It is preferred to explicitly set the X-XSS-Protection header to 0 because of the simple fact that having it explicitly disabled prevents XSS Auditor being enabled (which is enabled by default in older browsers unless specifically disabled). This header has a history of doing harm which is why all the browsers are removing it. There are cases where implementing XSS Auditor can implement cross-site information leaks and there are ways to bypass the Auditor.

The way I see it you have more to gain actively disabling it than not including it, and relying instead on a robust Content Security Policy (CSP) header. Even where older browsers don't support CSP I would still disable X-XSS-Protection just to be sure XSS Auditor is disabled as in some old browsers it is enabled by default as mentioned and may actually degrade the security of an old browser visiting the site.

A good discussion on why the X-XSS-Protection should be explicitly disabled instead of just left out can be found here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.