xXssProtection function
Middleware
xXssProtection()
The X-XSS-Protection
HTTP header aimed to offer a basic protection against cross-site scripting (XSS) attacks. However, you probably should disable it, which is what this middleware does.
Many browsers have chosen to remove it because of the unintended security issues it creates. Generally, you should protect against XSS with sanitization and a Content Security Policy. For more, read this GitHub issue.
This middleware sets the X-XSS-Protection
header to 0
.
import 'package:shelf_helmet/shelf_helmet.dart'
.addMiddleware(xXssProtection())
Implementation
Middleware xXssProtection() {
return (innerHandler) {
return (request) async {
final response = await innerHandler(request);
return response.change(
headers: {'x-xss-protection': '0', ...response.headersAll},
);
};
};
}