x-xss-protection
TypeScript icon, indicating that this package has built-in type declarations

2.0.0 • Public • Published

X-XSS-Protection middleware

The X-XSS-Protection HTTP header aimed to offer a basic protection against cross-site scripting (XSS) attacks. However, you probably should disable it, which is what this middleware does.

Many browsers have chosen to remove it because of the unintended security issues it creates. Generally, you should protect against XSS with sanitization and a Content Security Policy. For more, read this GitHub issue.

This middleware sets the X-XSS-Protection header to 0. For example:

const xXssProtection = require("x-xss-protection");
 
// Set "X-XSS-Protection: 0"
app.use(xXssProtection());

If you truly need the legacy behavior, you can write your own simple middleware and avoid installing this module. For example:

// NOTE: This is probably insecure!
app.use((req, res, next) => {
  res.setHeader("X-XSS-Protection", "1; mode=block");
  next();
});

Package Sidebar

Install

npm i x-xss-protection

Weekly Downloads

574,487

Version

2.0.0

License

MIT

Unpacked Size

4.59 kB

Total Files

6

Last publish

Collaborators

  • evanhahn