Skip to main content

Insecure or unset HTTP headers - X-XSS Protection

Need​

Implementation of secure and properly configured HTTP headers

Context​

  • Usage of Scala for building scalable and high-performance applications
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework

Description​

Non compliant code​

import play.api.mvc._

object Application extends Controller {

  def index = Action {
    Ok("Your application is ready.").withHeaders(
      "X-XSS-Protection" -> "1; mode=block"
    )
  }
}

The code above is a simple Play Framework controller that responds to HTTP requests with a text message "Your application is ready.".

The potential vulnerability lies in the HTTP response header X-XSS-Protection. This header is used to enable the Cross-Site Scripting (XSS) filter built into most recent web browsers. It's designed to enable the filter only for the particular site it is set on, and not for the other sites.

In the code above, the X-XSS-Protection header is set to 1; mode=block, which means that the browser will not only detect the potential XSS attacks, but will also prevent them by not rendering the page at all.

However, the X-XSS-Protection header is considered deprecated because it is not a part of the standard set of HTTP headers and its behavior may vary across different browsers. Moreover, it can introduce new security vulnerabilities like stored XSS vulnerabilities, if not properly handled.

An attacker can exploit this vulnerability by inserting malicious scripts into the stored data. When this data is later retrieved and displayed to the user, the script will be executed in the user's browser.

The recommendation is to remove the X-XSS-Protection header and rely on Content Security Policies (CSP) for preventing XSS attacks.

Steps​

  • Remove the X-XSS-Protection header from the response
  • Implement proper input validation and output encoding to prevent XSS attacks
  • Consider using Content Security Policy (CSP) to further mitigate XSS vulnerabilities

Compliant code​

import play.api.mvc._

object Application extends Controller {

  def index = Action {
    Ok("Your application is ready.")
  }
}

The previous version of the code was setting the X-XSS-Protection header in the HTTP response. This header is considered deprecated and its use can lead to stored XSS vulnerabilities.

The updated code removes the X-XSS-Protection header from the response. This is the first step in mitigating the potential vulnerability.

However, removing this header alone is not enough to prevent XSS attacks. It's important to also implement proper input validation and output encoding in your application. This will ensure that any input received from the user is safe to use and won't lead to any security issues.

Additionally, consider using a Content Security Policy (CSP) in your application. A CSP can help to prevent XSS attacks by specifying the domains that the browser should consider to be valid sources of executable scripts. A CSP can be implemented by setting the Content-Security-Policy header in your HTTP response.

Remember, security is a multi-layered approach. Removing deprecated headers is just one step in the process. Always ensure you're following best practices for input validation, output encoding, and using security headers like CSP.

References​

Last updated on