New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Explicit disable (unsafe) `X-XSS-Protection`-header #751

Open

NicolaiSoeborg wants to merge 1 commit into cloudflare:master from NicolaiSoeborg:patch-1

Commits on Jul 4, 2024

Explicit disable (unsafe) X-XSS-Protection-header

A bit counter-intuitive, but `X-XSS-Protection` is actually dangerous on (old) browsers supporting the spec.

In _filtering_ mode it easily allows attackers to remove critical blocks of JavaScript, which can introduce vulnerabilities in otherwise safe code: [PoC](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection#vulnerabilities_caused_by_xss_filtering).

In _blocking_ mode it can be used as an side-channel oracle, leaking cross origin bodies/tokens: [theory](https://portswigger.net/research/abusing-chromes-xss-auditor-to-steal-tokens) / [PoC](https://www.youtube.com/watch?v=HcrQy0C-hEA)

Hot take, this is a terrible header that shouldn't be included.  In this PR I explicit disable it, but this PR could also easily be refactored to completely remove the header.

Disabling it on modern browsers does nothing, as it is already disabled.

NicolaiSoeborg authored Jul 4, 2024