x-xss-protection

X-XSS-Protection middleware

The X-XSS-Protection HTTP header aimed to offer a basic protection against cross-site scripting (XSS) attacks. However, you probably should disable it, which is what this middleware does.

Many browsers have chosen to remove it because of the unintended security issues it creates. Generally, you should protect against XSS with sanitization and a Content Security Policy. For more, read this GitHub issue.

This middleware sets the X-XSS-Protection header to 0. For example:

const xXssProtection = require("x-xss-protection");

// Set "X-XSS-Protection: 0"
app.use(xXssProtection());

If you truly need the legacy behavior, you can write your own simple middleware and avoid installing this module. For example:

// NOTE: This is probably insecure!
app.use((req, res, next) => {
  res.setHeader("X-XSS-Protection", "1; mode=block");
  next();
});

Changelog

2.0.0 - 2016-04-29

Added

• Pass configuration to enable/disable default middlewares

Changed

• dnsPrefetchControl middleware is now enabled by default

Removed

• No more module aliases. There is now just one way to include each middleware
• frameguard can no longer be initialized with strings; you must use an object

Fixed

• Make hpkp lowercase in documentation
• Update hpkp spec URL in readmes
• Update frameguard header name in readme