Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Disable X-XSS-Protection filter, for safety #26

Merged
merged 1 commit into from
Apr 20, 2022
Merged

Disable X-XSS-Protection filter, for safety #26

merged 1 commit into from
Apr 20, 2022

Commits on Apr 20, 2022

  1. Disable X-XSS-Protection filter, for safety 

    Surprisingly, [`X-XSS-Protection` is safer when disabled][0], and
browsers are dropping support for it as a result. Because it's less safe
to enable the filter, this change sets the default (and only) value to
`0`, instead of `1; mode=block`.

This is a breaking change.

See [issue brokenhandsio#25][1].

[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
[1]: brokenhandsio#25
    @EvanHahn
    EvanHahn committed Apr 20, 2022
    Configuration menu
    Copy the full SHA
    2900d3e View commit details
    Browse the repository at this point in the history