Skip to content

/ metabase

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove deprecated `X-XSS-Protection` HTTP header #11444

Open
walterl opened this issue Dec 4, 2019 · 5 comments
Open

Remove deprecated `X-XSS-Protection` HTTP header #11444

walterl opened this issue Dec 4, 2019 · 5 comments
Labels
.Backend .Tech Debt or Refactoring Difficulty:Easy Security

Comments

@walterl
Copy link
Contributor

@walterl walterl commented Dec 4, 2019

From MDN:

This means that if you do not need to support legacy browsers, it is recommended that you use Content-Security-Policy without allowing unsafe-inline scripts instead.
@flamber
Copy link
Member

@flamber flamber commented Dec 4, 2019

I think this is kept around because of IE support. Same goes for X-Frame-Options, as per Cam.
@walterl
Copy link
Contributor Author

@walterl walterl commented Dec 4, 2019

@flamber Thanks for that! I'll follow up.
@walterl
Copy link
Contributor Author

@walterl walterl commented Dec 5, 2019

Interim update: Seems like we're no longer supporting many of those older browsers, so that older statement may not be applicable anymore. I'll update again when I have confirmation.
@flamber
Copy link
Member

@flamber flamber commented Dec 5, 2019 •
edited

@walterl That's great, if we're killing IE 😉 If you ask me, it's been dead for many years, but just a couple of months ago the were PR #10993, and we should then close IE specific issues as wontfix?
And document supported browsers #10310
@walterl
Copy link
Contributor Author

@walterl walterl commented Dec 5, 2019

@flamber Thanks for the extra info. I'll make sure that that's part of the conversation.
@flamber flamber mentioned this issue Dec 5, 2019
Merged
@mazameli mazameli removed the .Needs Triage label Jan 17, 2020
@calabacito calabacito mentioned this issue Mar 20, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
.Backend .Tech Debt or Refactoring Difficulty:Easy Security
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants
@walterl @flamber @mazameli
You can’t perform that action at this time.