xXssProtection function

Middleware xXssProtection()

The X-XSS-Protection HTTP header aimed to offer a basic protection against cross-site scripting (XSS) attacks. However, you probably should disable it, which is what this middleware does.

Many browsers have chosen to remove it because of the unintended security issues it creates. Generally, you should protect against XSS with sanitization and a Content Security Policy. For more, read this GitHub issue.

This middleware sets the X-XSS-Protection header to 0.

import 'package:shelf_helmet/shelf_helmet.dart'

.addMiddleware(xXssProtection())

Implementation

Middleware xXssProtection() {
  return (innerHandler) {
    return (request) async {
      final response = await innerHandler(request);
      return response.change(
        headers: {'x-xss-protection': '0', ...response.headersAll},
      );
    };
  };
}