x-xss-protection

X-XSS-Protection middleware

Trying to prevent: Cross-site scripting attacks (XSS), a subset of the above.

How we mitigate this: The X-XSS-Protection HTTP header is a basic protection against XSS. It was originally by Microsoft but Chrome has since adopted it as well. To use it:

var xssFilter = require('x-xss-protection');
app.use(xssFilter());

This sets the X-XSS-Protection header. On modern browsers, it will set the value to 1; mode=block. On old versions of Internet Explorer, this creates a vulnerability (see here and here), and so the header is set to 0 to disable it. To force the header on all versions of IE, add the option:

app.use(xssFilter({ setOnOldIE: true }));
// This has some security problems for old IE!

Limitations: This isn't anywhere near as thorough as Content Security Policy. It's only properly supported on IE9+ and Chrome; no other major browsers support it at this time. Old versions of IE support it in a buggy way, which we disable by default.