Skip to main content

Insecure or unset HTTP headers - X-XSS Protection

Need​

Implementation of secure and properly configured HTTP headers

Context​

  • Usage of Ruby 2.0+ for Ruby language development
  • Usage of Rails framework for building web applications

Description​

Non compliant code​

class ApplicationController < ActionController::Base
  before_action :set_headers

  def set_headers
    response.headers['X-XSS-Protection'] = '1; mode=block'
  end
end

In the above code snippet, a Ruby on Rails application is setting the X-XSS-Protection HTTP header in the ApplicationController. This is done in the set_headers method, which is called before every action due to the before_action directive.

The X-XSS-Protection header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. The 1; mode=block option enables XSS filtering (usually kept as default in browsers) and rather than sanitizing the page, the browser will prevent rendering of the page if an attack is detected.

However, this header is considered deprecated. Its usage is not recommended because it can introduce additional security issues such as XSS vulnerabilities. For example, attackers can abuse its poorly implemented filter to introduce XSS vulnerabilities in websites that would otherwise be safe. Also, modern web browsers have robust built-in XSS protections that don't rely on the X-XSS-Protection header.

Therefore, the use of X-XSS-Protection header may lead to stored XSS vulnerabilities in the application. It is recommended to remove this header and rely on the Content Security Policy header to prevent XSS attacks.

Steps​

  • Remove the 'X-XSS-Protection' header from the 'set_headers' method.
  • Implement a Content Security Policy (CSP) to mitigate XSS attacks.
  • Ensure that user input is properly sanitized and validated before displaying it in the application.
  • Use a robust HTML escaping mechanism when rendering user-generated content.
  • Regularly update the Ruby on Rails framework and its dependencies to benefit from security patches and fixes.

Compliant code​

class ApplicationController < ActionController::Base
  before_action :set_headers

  def set_headers
    # Removed the deprecated 'X-XSS-Protection' header
  end
end

The original code was setting the 'X-XSS-Protection' HTTP header in the 'set_headers' method. This header is considered deprecated and its use can lead to stored XSS vulnerabilities.

The fixed code removes this header. However, this is only part of the solution. To fully mitigate the risk of XSS attacks, you should also:

  • Implement a Content Security Policy (CSP). This is a security standard that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. You can set a CSP using the 'Content-Security-Policy' HTTP header.

  • Sanitize and validate user input before displaying it in the application. This can help to prevent malicious scripts from being injected into your web pages.

  • Use a robust HTML escaping mechanism when rendering user-generated content. This can help to ensure that any potentially harmful characters are rendered harmless.

  • Regularly update the Ruby on Rails framework and its dependencies. This can help to ensure that you are benefiting from the latest security patches and fixes.

References​

Last updated on