-
Notifications
You must be signed in to change notification settings - Fork 53
TWA 0212
Ulrich Berntien edited this page Aug 10, 2020
·
1 revision
"X-XSS-Protection missing"
The server sends no "X-XSS-Protection" entry in the HTTP header to the web browser.
The X-XSS-Protection (cross-site scripting attack filtering) with blocking should by enabled in the web browser by the web site. If the web browser supports X-XSS-Protection it will increase the security of the web application.
Set the X-XSS-Protection to 1; mode=block in the web server configuration or in the web application (e.g. PHP scripts).