From 463f61fac74ea438a020f44b44e67c650fe73cc3 Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Mon, 12 Mar 2018 13:41:18 -0400 Subject: [PATCH] Modify XSS-Protection directive --- confluent_server/confluent/httpapi.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/confluent_server/confluent/httpapi.py b/confluent_server/confluent/httpapi.py index cfe19ec2..e4fde6c6 100644 --- a/confluent_server/confluent/httpapi.py +++ b/confluent_server/confluent/httpapi.py @@ -400,7 +400,7 @@ def resourcehandler_backend(env, start_response): ('Pragma', 'no-cache'), ('X-Content-Type-Options', 'nosniff'), ('Content-Security-Policy', "default-src 'self'"), - ('X-XSS-Protection', '1'), ('X-Frame-Options', 'deny'), + ('X-XSS-Protection', '1; mode=block'), ('X-Frame-Options', 'deny'), ('Strict-Transport-Security', 'max-age=86400'), ('X-Permitted-Cross-Domain-Policies', 'none')] reqbody = None