U.S. Dept Of Defense · Report #289846

X-XSS-Protection -> Misconfiguration

Validstatus

lowseverity

7upvotes

15 Dec 2017disclosed

How it was found

Hi there,

URL: https://www.sfl-tap.army.mil/ I have seen that the website is using the X-XSS-Protection Header.

But it has a strange configuration. When I take a look at securityheaders, I've seen that you guys use this as configuration.

X-XSS-Protection: DENY

DENY is used for the X-Frame Option instead of the X-XSS-Protection. The good configuration should be:

XSS-XSS-Protection: 1; mode=block

And not DENY. This is used for the X-Frame Option.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original