search

hoellen / docker-nextcloud

All-in-one Nextcloud Docker image. Alpine-based, rootless and simple.
31 stars 5 forks source link

Fix header "X-XSS-Protection" for Nextcloud 24 #23

Closed mhbates closed 2 years ago

mhbates commented 2 years ago

Nextcloud 24 throws the following error: The "X-XSS-Protection" HTTP header doesn't contain "1; mode=block". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.

This happens even when nginx on the host side is configured correctly. If you inspect the page, you'll see duplicate headers, one of which is set to 0. When I go into the container's nginx conf (/etc/nginx/conf.d/default.conf), I see add_header X-XSS-Protection "0" always;.

Since it doesn't seem like I can do much via the container shell, I copied the file to the host, edited it, then copied it back to the container, and restarted it. That fixed it.

hoellen commented 2 years ago

X-XSS-Protection is disabled, because it is unsafe and obsolete. It is superseded by CSP. Nextcloud should remove this check. You can find more information here: