Why this error in dev console of chrome when using x-xss-protection?

security header xss
Vamsi Krishna picture Vamsi Krishna · Mar 31, 2016 · Viewed 53.6k times · Source

How to fix this error in console?

Error parsing header X-XSS-Protection: 1; mode=block, 1;
mode=block:expected semicolon at character position 14.
The default protections will be applied.

Answer

David picture David · Nov 6, 2016

If the error is shown even you send the right header, check if you send the header perhaps twice. This is shown in the error-console below network and you click on any file.

Sending the header twice can happen if for the server 

add_header X-XSS-Protection "1; mode=block";

is noted in two different include-files or one include-file is included twice. Browsers or at least chrome is concatenating the two headers then internally and the applied WRONG rule is then, like shown in the question:

X-XSS-Protection: "1; mode=block, 1; mode=block"

Related questions

X-Frame-Options Allow-From multiple domains

I have an ASP.NET 4.0 IIS7.5 site which I need secured using the X-Frame-Options header. I also need to enable my site pages to be iframed from my same domain as well as from my facebook app. Currently I have …

Read More
Remove Server Response Header IIS7

Is there any way to remove "Server" response header from IIS7? There are some articles showing that using HttpModules we can achieve the same thing. This will be helpful if we don't have admin right to server. Also I don't …

Read More
How can I prevent SQL injection in PHP?

If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example: $unsafe_variable = $_POST['user_input']; mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')"); That's …

Read More