⚠️ This issue respects the following points: ⚠️
Bug description
The Nextcloud administration page shows the following warning:
The "X-XSS-Protection" HTTP header does not contain "1; mode=block". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
However, the X-XSS-Protection header is deprecated. OWASP recommends you remove the header from your webserver
It shows the following warning when the header is used:
Warning: The X-XSS-Protection header has been deprecated by modern browsers and its use can introduce additional security issues on the client side. As such, it is recommended to set the header as X-XSS-Protection: 0 in order to disable the XSS Auditor, and not allow it to take the default behavior of the browser handling the response. Please use Content-Security-Policy instead.
Steps to reproduce
- Log into a Nextcloud instance as admin
- Navigate towards the Administration > Overview page
- Observe the recommendation of Nextcloud to set the
X-XSS-Protection header
Expected behavior
Do not show this recommendation, and possibly advice users to unset the HTTP header in order to inform them of its deprecation.
Bug description
The Nextcloud administration page shows the following warning:
However, the
X-XSS-Protectionheader is deprecated. OWASP recommends you remove the header from your webserverIt shows the following warning when the header is used:
Steps to reproduce
X-XSS-ProtectionheaderExpected behavior
Do not show this recommendation, and possibly advice users to unset the HTTP header in order to inform them of its deprecation.