jandieman
/
searxng
mirror of https://github.com/searxng/searxng.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

[mod] remove X-XSS-Protection headers 

Deprecated header not used by browsers nowadays[1]:

"""In modern browsers, X-XSS-Protection has been deprecated in favor of the
Content-Security-Policy to disable the use of inline JavaScript. Its use can
introduce XSS vulnerabilities in otherwise safe websites. This should not be
used unless you need to support older web browsers that don’t yet support CSP.
It is thus recommended to set the header as X-XSS-Protection: 0."""[2]

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
[2] https://infosec.mozilla.org/guidelines/web_security#x-xss-protection

Closes: https://github.com/searxng/searxng/issues/3171
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
This commit is contained in:
Markus Heiser 2024-01-31 08:52:07 +01:00 committed by Markus Heiser
parent dca78f920f
commit ab8e5383fb
3 changed files with 0 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/admin/settings/settings_server.rst
View File

@ -16,7 +16,6 @@
image_proxy: false image_proxy: false
default_http_headers: default_http_headers:
X-Content-Type-Options : nosniff X-Content-Type-Options : nosniff
X-XSS-Protection : 1; mode=block
X-Download-Options : noopen X-Download-Options : noopen
X-Robots-Tag : noindex, nofollow X-Robots-Tag : noindex, nofollow
Referrer-Policy : no-referrer Referrer-Policy : no-referrer

1
searx/settings.yml
View File

@ -88,7 +88,6 @@ server:
method: "POST" method: "POST"
default_http_headers: default_http_headers:
X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Download-Options: noopen X-Download-Options: noopen
X-Robots-Tag: noindex, nofollow X-Robots-Tag: noindex, nofollow
Referrer-Policy: no-referrer Referrer-Policy: no-referrer

1
tests/unit/settings/user_settings.yml
View File

@ -19,7 +19,6 @@ server:
method: "POST" method: "POST"
default_http_headers: default_http_headers:
X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Download-Options: noopen X-Download-Options: noopen
X-Robots-Tag: noindex, nofollow X-Robots-Tag: noindex, nofollow
Referrer-Policy: no-referrer Referrer-Policy: no-referrer