Disabled X-XSS-Protection Header

Severity: Information

Summary#

Invicti detected a disabled X-XSS-Protection header which means that this website could be at risk of a Cross-site Scripting (XSS) attacks.

Internet Explorer's built-in cross-site scripting protection can be disabled by using the following HTTP Header : X-XSS-Protection: 0

Impact#

This issue is reported as additional information only. There is no direct impact arising from this issue.

Remediation#

Add the X-XSS-Protection header with a value of "1; mode= block".

```
X-XSS-Protection: 1; mode=block
```

Please also be advised that in some specific cases enabling XSS filter can be abused by attackers. However, in most cases, it provides basic protection for users against XSS attacks.

Classifications#

WASC-15, CWE-693, ISO27001-A.14.1.2

Invicti Security Insights

What is a cross-site scripting vulnerability?
What is Reflected XSS and How to Prevent It
Real-Life Vulnerabilities Reported by Invicti
XSS Filter Evasion
Goodbye XSS Auditor