vw_small

commit 81f0c2b0e8b9f2b7cdb14a45047013806b34d815
parent 80d8aa72394bb9897f9c03b94ae65dcfa7110d67
Author: Daniel García <dani-garcia@users.noreply.github.com>
Date:   Sat, 26 Mar 2022 16:18:34 +0100

Merge branch 'x-xss-protection' of https://github.com/Wonderfall/vaultwarden into Wonderfall-x-xss-protection

Diffstat:
M
src/util.rs
 | 
3
++-

1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/util.rs b/src/util.rs
@@ -34,7 +34,8 @@ impl Fairing for AppHeaders {
         res.set_raw_header("Referrer-Policy", "same-origin");
         res.set_raw_header("X-Frame-Options", "SAMEORIGIN");
         res.set_raw_header("X-Content-Type-Options", "nosniff");
-        res.set_raw_header("X-XSS-Protection", "1; mode=block");
+        // Obsolete in modern browsers, unsafe (XS-Leak), and largely replaced by CSP
+        res.set_raw_header("X-XSS-Protection", "0");
         let csp = format!(
             // Chrome Web Store: https://chrome.google.com/webstore/detail/bitwarden-free-password-m/nngceckbapebfimnlniiiahkandclblb
             // Edge Add-ons: https://microsoftedge.microsoft.com/addons/detail/bitwarden-free-password/jbkfoedolllekgbhcbcoahefnbanhhlh?hl=en-US