TWA 0210

TWA-0210

Message

"X-XSS-Protection is '0'; XSS filtering disabled"

Explanation

The server sends "X-XSS-Protection 0" to the web browser. This disables the XSS (cross-site scripting) filtering in the web browsers. (If the web browser supports XSS filtering and the XSS filtering is enabled by default.)

The X-XSS-Protection should only be disabled in the rare case if a web application can't work with X-XSS-Protection.

Remediation

Set the X-XSS-Protection to 1; mode=block in the web server configuration or in the web application (e.g. PHP scripts).

Warning

The XSS protection by this flag is weak because a lot of modern browsers (e.g. Chrome 78, Edge 17, Firefox 79) don't support this feature. The Content-Security-Policy could be used additionaly.

See

• OWAPS: Cross Site Scripting
• MDN web docs: X-XSS-Protection
• See also MDN web docs: Content-Security-Policy as another guard against XSS.