Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

High

X-XSS-Protection

Activates the browser's built-in XSS filter to detect and block reflected cross-site scripting attacks.

Risk

Reflected XSS attacks trick users into clicking links containing malicious scripts. Without this header, older browsers won't activate their XSS filter, allowing the attack payload to execute. While modern browsers rely more on CSP, this header provides an additional safety net for older clients.

Solution

Set X-XSS-Protection to block mode. Note that this header is most useful as a complement to CSP, not a replacement.

Example

X-XSS-Protection: 1; mode=block

MDN - X-XSS-Protection

Comments (0)

No messages yet.