# x-xss-protection

> Middleware to disable the X-XSS-Protection header

Latest version **2.0.0** (published 2020-08-02) · MIT license · 0 weekly downloads

## Install

```sh
npm install x-xss-protection
pnpm add x-xss-protection
yarn add x-xss-protection
bun add x-xss-protection
```

## Health

**Score 40/100 (D)** — status: abandoned.

Positive: has types; no vulnerabilities; high maintenance score; popular repo.

Warnings: low downloads; no esm support.

Negative: abandoned.

## Facts

| | |
|---|---|
| Version | 2.0.0 |
| Published | 2020-08-02 |
| First published | 2014-10-28 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | >=10.0.0 |
| Dependencies | 0 |
| Unpacked size | 4.5 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 10733 |
| Author | Adam Baldwin |
| Maintainers | evanhahn |
| Keywords | express, security, x-xss-protection |

## Links

- npm: https://www.npmjs.com/package/x-xss-protection
- Repository: https://github.com/helmetjs/helmet
- Homepage: https://helmetjs.github.io/
- Issues: https://github.com/helmetjs/helmet/issues
- npm.io page: https://npm.io/package/x-xss-protection

## Recent versions

- 2.0.0 (latest) — 2020-08-02
- 1.3.0 — 2019-09-02
- 1.2.0 — 2019-06-15
- 1.1.0 — 2018-03-02
- 1.0.0 — 2015-12-18
- 0.2.0 — 2015-10-23
- 0.1.2 — 2015-03-01
- 0.1.1 — 2014-12-08
- 0.1.0 — 2014-10-28

## README

# X-XSS-Protection middleware

The `X-XSS-Protection` HTTP header aimed to offer a basic protection against cross-site scripting (XSS) attacks. _However, you probably should disable it_, which is what this middleware does.

Many browsers have chosen to remove it because of the unintended security issues it creates. Generally, you should protect against XSS with sanitization and a Content Security Policy. For more, read [this GitHub issue](https://github.com/helmetjs/helmet/issues/230).

This middleware sets the `X-XSS-Protection` header to `0`. For example:

```javascript
const xXssProtection = require("x-xss-protection");

// Set "X-XSS-Protection: 0"
app.use(xXssProtection());
```

If you truly need the legacy behavior, you can write your own simple middleware and avoid installing this module. For example:

```javascript
// NOTE: This is probably insecure!
app.use((req, res, next) => {
  res.setHeader("X-XSS-Protection", "1; mode=block");
  next();
});
```

---
_Source: https://npm.io/package/x-xss-protection · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._