Disable x-xss-protection as it's the defaults now

Both rails and secure header are now shipping with 0 by default. See: https://www.github.com/github/secure_headers/issues/439
jrafanie · Sep 20, 2024 · a393d4a · a393d4a
1 parent f7395d4
commit a393d4a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 4 deletions.
diff --git a/config/application.rb b/config/application.rb
@@ -118,9 +118,6 @@ class Application < Rails::Application
  # https://github.com/rails/rails/blob/d437ae311f1b9dc40b442e40eb602e020cec4e49/railties/lib/rails/application/configuration.rb#L92
  config.load_defaults 7.0
 
- # TODO: this is the only change we had from defaults in 7.0. See secure_headers.rb. It's 0 in defaults.
- config.action_dispatch.default_headers["X-XSS-Protection"] = "1; mode=block"
-
  # TODO: Find and fixed any deprecated behavior. Opt in later.
  config.active_support.remove_deprecated_time_with_zone_name = false
  config.active_support.disable_to_s_conversion = false

diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb
@@ -14,7 +14,9 @@
  #FYI, this was deprecated and disabled in rails 7. Using content security policy is the desired behavior going forward:
  # https://github.com/rails/rails/commit/1f4714c3f798df227222f531141880b8e1b4170a
  # https://github.com/rails/rails/blob/d437ae311f1b9dc40b442e40eb602e020cec4e49/railties/lib/rails/application/configuration.rb#L227
- config.x_xss_protection = "1; mode=block"
+ # Disable x-xss-protection as it's being dropped by other big stakeholders for legitimate security reasons:
+ # https://github.com/github/secure_headers/issues/439
+ config.x_xss_protection = "0"
  config.referrer_policy = "no-referrer-when-downgrade"
  # Content-Security-Policy
  # Need google fonts in fonts_src for https://fonts.googleapis.com/css?family=IBM+Plex+Sans+Condensed%7CIBM+Plex+Sans:400,600&display=swap (For carbon-charts download)