From f9a50f988ae1c1f26dc69e94c31e8edd6077d857 Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Fri, 18 Jun 2021 04:38:26 -0400 Subject: [PATCH] add obsolete X-XSS-Protection header --- nginx/snippets/security-headers.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nginx/snippets/security-headers.conf b/nginx/snippets/security-headers.conf index 4110c9f..c0a7198 100644 --- a/nginx/snippets/security-headers.conf +++ b/nginx/snippets/security-headers.conf @@ -3,3 +3,6 @@ add_header X-Content-Type-Options "nosniff" always; # obsolete when client system time is correct add_header Expect-CT "enforce, max-age=63072000" always; + +# obsolete and replaced with strong Content-Security-Policy +add_header X-XSS-Protection "1; mode=block" always;