TWA 0211

TWA-0211

Message

"X-XSS-Protection sanitizes but doesn't block, consider mode=block?"

Explanation

The server sends not X-XSS-Protection: 1; mode=block. The server sends only X-XSS-Protection: 1 alone or with another mode.

If a web browser with enabled XSS (cross-site scripting) filtering detects a XSS attack several reactions of the web browser are possible. With mode=block the web browser will not render and display the page. This is a safe reaction of the web browser should be selected by the web server via X-XSS-Protection.

Remediation

Set the X-XSS-Protection to 1; mode=block in the web server configuration or in the web application (e.g. PHP scripts).

See

• TWA-0210
• MDN web docs: X-XSS-Protection