Configuring X-XSS-Protection

There are two configuration options

• policy can be set to :
  • Disabled
  • FilterDisabled
  • FilterEnabled
• blockMode adds mode=block in the header, defaults to false

Configuration	Resulting header
policy=”Disabled”	None
policy=”FilterDisabled”	X-XSS-Protection: 0
policy=”FilterEnabled” blockMode=”true”	X-XSS-Protection: 1; mode=block

Register the middleware in the startup class:

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
    {
        ...

        app.UseStaticFiles();

        app.UseXXssProtection(options => options.EnabledWithBlockMode());

        app.UseMvc(...);
    }

Or as an MVC attribute, defaults to “FilterDisabled” blockMode=”true”:

[XXssProtection]
[XXssProtection(Policy = XXssProtectionPolicy.Disabled)]

The header is omitted for redirects and static content.