jellyfin/jellyfin.org
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.org.git synced 2024-11-26 23:50:44 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

remove X-XSS-Protection (#1151)
Some checks failed
build / Build (push) Has been cancelled
Details
lint / Lint TypeScript/JavaScript (push) Has been cancelled
Details
lint / Lint Markdown (push) Has been cancelled
Details
test / Test URLs (test:blog-urls) (push) Has been cancelled
Details
test / Test URLs (test:docs-urls) (push) Has been cancelled
Details
test / Test URLs (test:web-urls) (push) Has been cancelled
Details
build / Deploy to GitHub Pages (push) Has been cancelled
Details
build / Deploy to Cloudflare Pages (push) Has been cancelled
Details

Browse Source 
why is this line not removed, when it is dangerous and obsolete?

According to https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection, we should remove it.
This commit is contained in:
jameskimmel 2024-10-07 20:16:56 +02:00 committed by GitHub
parent 0528023c7f
commit 41089bfb08
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 0 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/general/networking/nginx.md
View File

@ -58,7 +58,6 @@ server {
# Security / XSS Mitigation Headers
# NOTE: X-Frame-Options may cause issues with the webOS app
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "0"; # Do NOT enable. This is obsolete/dangerous
add_header X-Content-Type-Options "nosniff";
# Permissions policy. May cause issues with some clients