The X-XSS-Protection response header is a major and most used web security mechanism of Internet Explorer. The Chrome and Safari Web browsers to prevent cross-site scripting. This header content will prevent the pages from loading when they expose reflected cross-site scripting attacks. The applications which do not have a X-XSS-Protection header, it means the application is at risk due to its vulnerability to Cross-site Scripting attacks. The value of that X-XSS-Protection header only is zero or one.

• Environment:  Tested in Apache Web Server 2.4, Browse the URL and Look at your Response Header and you can see there is no X-XSS header related info.

Solution

To enable the X-XSS protection set the header to:

X-XSS-Protection: 1; mode=block

Browse the URL and Look at your Response Header and you can see there is  X-XSS header related info.

Conclusion

Fixing X-Xss protection header alone is not going to protect your website from all the security threats. Ensure to follow Web Application security checklist and leverage eCyLabs Web Application Firewall could protect from this kind of issues at the Firewall level.

---

Leverage eCyLabs ASPM to get 360 degree view of your application security posture from code to cloud. Our Marketplace approach is cost-effective and efficient way for security and compliance monitoring.