Sunil Mohan Adapa da24f852cf
django: Remove use of X-XSS-Protection header
- This header is not supported by modern browsers[1]

- Our Content-Security-Policy header already does a better job.

- Django 4.0 removed this setting and does nothing with it.

Links:

1) https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

Tests:

- Without the patch X-XSS-Protection header is sent and with the patch it is not
sent.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-23 21:47:22 -04:00
..
2021-09-20 16:50:37 -04:00
2023-08-14 21:11:52 -04:00
2022-08-29 08:28:44 -04:00
2021-09-20 16:50:37 -04:00
2023-05-07 13:11:27 -04:00