Skip to content

Commit cf56fc9

Browse files
authored
Update default X-XSS-Protection value to 0 (#479)
This PR updates the default value of the `X-XSS-Protection` header to 0. There's further discussion here about the reasons for this: #439. ## All PRs: * [x] Has tests * [x] Documentation updated Closes #439
1 parent b122c2f commit cf56fc9

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ X-Content-Type-Options: nosniff
105105
X-Download-Options: noopen
106106
X-Frame-Options: sameorigin
107107
X-Permitted-Cross-Domain-Policies: none
108-
X-Xss-Protection: 1; mode=block
108+
X-Xss-Protection: 0
109109
```
110110

111111
## API configurations

lib/secure_headers/headers/x_xss_protection.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module SecureHeaders
33
class XXssProtectionConfigError < StandardError; end
44
class XXssProtection
55
HEADER_NAME = "X-XSS-Protection".freeze
6-
DEFAULT_VALUE = "1; mode=block"
6+
DEFAULT_VALUE = "0".freeze
77
VALID_X_XSS_HEADER = /\A[01](; mode=block)?(; report=.*)?\z/
88

99
class << self

0 commit comments

Comments
 (0)