mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-03-11 09:04:54 +00:00
- This header is not supported by modern browsers[1] - Our Content-Security-Policy header already does a better job. - Django 4.0 removed this setting and does nothing with it. Links: 1) https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection Tests: - Without the patch X-XSS-Protection header is sent and with the patch it is not sent. Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org> Reviewed-by: James Valleroy <jvalleroy@mailbox.org>