Default X-Xss-Protection header value to "0"
Closes gh-9631
This commit is contained in:
Daniel Garnier-Moiroux
committed by
Steve Riesenberg
Steve Riesenberg
parent
dcda899c8c
commit
27059ced87
@@ -33,7 +33,7 @@ Expires: 0
|
||||
X-Content-Type-Options: nosniff
|
||||
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
|
||||
X-Frame-Options: DENY
|
||||
X-XSS-Protection: 1; mode=block
|
||||
X-XSS-Protection: 0
|
||||
----
|
||||
====
|
||||
|
||||
@@ -209,18 +209,14 @@ See the relevant sections to see how to customize the defaults for both xref:ser
|
||||
====
|
||||
|
||||
Some browsers have built-in support for filtering out https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OWASP-DV-001)[reflected XSS attacks].
|
||||
This is by no means foolproof but does assist in XSS protection.
|
||||
The filter has been deprecated in major browsers, and https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection[current OWASP recommendation] is to explicitly set the header to 0.
|
||||
|
||||
The filtering is typically enabled by default, so adding the header typically just ensures it is enabled and instructs the browser what to do when a XSS attack is detected.
|
||||
For example, the filter might try to change the content in the least invasive way to still render everything.
|
||||
At times, this type of replacement can become an https://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/[XSS vulnerability in itself].
|
||||
Instead, it is best to block the content rather than attempt to fix it.
|
||||
By default, Spring Security blocks the content by using the following header:
|
||||
|
||||
====
|
||||
[source]
|
||||
----
|
||||
X-XSS-Protection: 1; mode=block
|
||||
X-XSS-Protection: 0
|
||||
----
|
||||
====
|
||||
|
||||
|
||||
@@ -255,8 +255,8 @@ fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
|
||||
|
||||
[[webflux-headers-xss-protection]]
|
||||
== X-XSS-Protection
|
||||
By default, Spring Security instructs browsers to block reflected XSS attacks by using the <<headers-xss-protection,X-XSS-Protection header>.
|
||||
You can disable `X-XSS-Protection`:
|
||||
By default, Spring Security instructs browsers to disable the XSS Auditor by using <<headers-xss-protection,X-XSS-Protection header>.
|
||||
You can disable the `X-XSS-Protection` header entirely:
|
||||
|
||||
.X-XSS-Protection Customization
|
||||
====
|
||||
@@ -291,6 +291,41 @@ fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
|
||||
----
|
||||
====
|
||||
|
||||
You can also change the header value:
|
||||
|
||||
.X-XSS-Protection Explicit header value
|
||||
====
|
||||
.Java
|
||||
[source,java,role="primary"]
|
||||
----
|
||||
@Bean
|
||||
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
|
||||
http
|
||||
// ...
|
||||
.headers(headers -> headers
|
||||
.xssProtection(xssProtection -> xssProtection.headerValue(XXssProtectionServerHttpHeadersWriter.HeaderValue.ENABLED_MODE_BLOCK))
|
||||
);
|
||||
return http.build();
|
||||
}
|
||||
----
|
||||
|
||||
.Kotlin
|
||||
[source,kotlin,role="secondary"]
|
||||
----
|
||||
@Bean
|
||||
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
|
||||
return http {
|
||||
// ...
|
||||
headers {
|
||||
xssProtection {
|
||||
headerValue = XXssProtectionServerHttpHeadersWriter.HeaderValue.ENABLED_MODE_BLOCK
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
----
|
||||
====
|
||||
|
||||
[[webflux-headers-csp]]
|
||||
== Content Security Policy (CSP)
|
||||
By default, Spring Security does not add xref:features/exploits/headers.adoc#headers-csp[Content Security Policy], because a reasonable default is impossible to know without the context of the application.
|
||||
|
||||
@@ -571,23 +571,10 @@ This is in no-way a full protection to XSS attacks!
|
||||
Do not include the header for https://en.wikipedia.org/wiki/Cross-site_scripting#Non-Persistent[reflected / Type-1 Cross-Site Scripting (XSS)] protection.
|
||||
|
||||
|
||||
[[nsa-xss-protection-enabled]]
|
||||
* **xss-protection-enabled**
|
||||
Explicitly enable or disable https://en.wikipedia.org/wiki/Cross-site_scripting#Non-Persistent[reflected / Type-1 Cross-Site Scripting (XSS)] protection.
|
||||
|
||||
|
||||
[[nsa-xss-protection-block]]
|
||||
* **xss-protection-block**
|
||||
When true and xss-protection-enabled is true, adds mode=block to the header.
|
||||
This indicates to the browser that the page should not be loaded at all.
|
||||
When false and xss-protection-enabled is true, the page will still be rendered when an reflected attack is detected but the response will be modified to protect against the attack.
|
||||
Note that there are sometimes ways of bypassing this mode which can often times make blocking the page more desirable.
|
||||
|
||||
[[nsa-xss-protection-header-value]]
|
||||
* **xss-protection-header-value**
|
||||
Explicitly set the value for https://en.wikipedia.org/wiki/Cross-site_scripting#Non-Persistent[reflected / Type-1 Cross-Site Scripting (XSS)] header.
|
||||
One of: "0", "1", "1; mode=block".
|
||||
When set, overrides both enabled and block attributes.
|
||||
One of: "0", "1", "1; mode=block". Defaults to "0".
|
||||
|
||||
|
||||
[[nsa-xss-protection-parents]]
|
||||
|
||||
@@ -529,9 +529,10 @@ class SecurityConfig {
|
||||
[[servlet-headers-xss-protection]]
|
||||
== X-XSS-Protection
|
||||
|
||||
By default, Spring Security instructs browsers to block reflected XSS attacks by using the <<headers-xss-protection,X-XSS-Protection header>.
|
||||
By default, Spring Security instructs browsers to disable the XSS Auditor by using <<headers-xss-protection,X-XSS-Protection header>.
|
||||
However, you can change this default.
|
||||
For example, the following configuration specifies that Spring Security should no longer instruct browsers to block the content:
|
||||
For example, the following configuration specifies that Spring Security instruct compatible browsers to enable filtering,
|
||||
and block the content:
|
||||
|
||||
.X-XSS-Protection Customization
|
||||
====
|
||||
@@ -548,7 +549,7 @@ public class WebSecurityConfig {
|
||||
// ...
|
||||
.headers(headers -> headers
|
||||
.xssProtection(xss -> xss
|
||||
.block(false)
|
||||
.headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK)
|
||||
)
|
||||
);
|
||||
return http.build();
|
||||
@@ -563,7 +564,7 @@ public class WebSecurityConfig {
|
||||
<!-- ... -->
|
||||
|
||||
<headers>
|
||||
<xss-protection block="false"/>
|
||||
<xss-protection headerValue="1; mode=block"/>
|
||||
</headers>
|
||||
</http>
|
||||
----
|
||||
@@ -581,7 +582,7 @@ class SecurityConfig {
|
||||
http {
|
||||
headers {
|
||||
xssProtection {
|
||||
block = false
|
||||
headerValue = XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user