search

andrewlock / NetEscapades.AspNetCore.SecurityHeaders

Small package to allow adding security headers to ASP.NET Core websites
MIT License
701 stars 73 forks source link

Remove X-XSS-Protection from defaults #163

Closed EddyCwdry closed 3 months ago

EddyCwdry commented 4 months ago

The header X-Xss-Protection: 1; mode=block is considered unsafe to use and should not be included in the default headers given that it is more likely to introduce vulnerabilities than protect the end user when implemented by a naive developer.

See:

Extract from MDN for the lazy (emphasis my own):

This feature is non-standard and is not on a standards track. Do not use it on production sites facing the Web: it will not work for every user. There may also be large incompatibilities between implementations and the behavior may change in the future.

andrewlock commented 3 months ago

Duplicate of #141 - I'm considering a major version and including this change, thanks 👍