X-XSS-Protection
Older browsers included a heuristic XSS filter, and the X-XSS-Protection unofficial response header controlled whether that filter was active.
Usage
The X-XSS-Protection header controlled a browser-level heuristic filter designed to detect reflected cross-site scripting attacks. When enabled, the browser scanned incoming HTML for patterns matching URL parameters, and blocked or sanitized the suspicious content.
The XSS auditor approach proved unreliable. Attackers found ways to bypass the filter, and in some cases the filter itself created new vulnerabilities by selectively removing page content, changing application behavior in exploitable ways. Browser vendors retired the feature in favor of the more robust protections offered by Content-Security-Policy.
Values
0
The value 0 disables the XSS filter. This is now the
recommended value when the header is sent, because a
partially functioning filter introduces more risk than no
filter at all.
1
The value 1 enables the XSS filter. When a reflected XSS
attack is detected, the browser sanitizes the page by
removing the suspected malicious content.
1; mode=block
The 1; mode=block value enables the filter and instructs
the browser to block rendering of the entire page rather
than attempting to sanitize the content. This avoids the
selective-removal vulnerabilities present in the default
sanitization mode.
1; report=``
The 1; report=<url> value enables the filter and directs
the browser to sanitize the page while sending a violation
report to the specified URL. This reporting mechanism was a
Chromium-specific extension.
Example
Disabling the XSS filter explicitly, the recommended configuration for sites relying on Content-Security-Policy:
X-XSS-Protection: 0
Enabling the filter in block mode, a legacy configuration for environments where CSP deployment is not available:
X-XSS-Protection: 1; mode=block
A defense-in-depth configuration pairing the disabled auditor with a CSP policy restricting script sources:
X-XSS-Protection: 0
Content-Security-Policy: script-src 'self'