From 389438d18b51bd254acd21bf3683407b8bcaa9ce Mon Sep 17 00:00:00 2001
From: Giuseppe C <1191978+AvverbioPronome@users.noreply.github.com>
Date: Sun, 8 May 2022 21:11:01 +0200
Subject: [PATCH] Update X-XSS-Protection to current recommendation

See:

- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection and
- https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection
---
 core/nginx/conf/nginx.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/nginx/conf/nginx.conf b/core/nginx/conf/nginx.conf
index 4e6919f8..28e19f04 100644
--- a/core/nginx/conf/nginx.conf
+++ b/core/nginx/conf/nginx.conf
@@ -117,7 +117,7 @@ http {
       add_header X-Frame-Options 'SAMEORIGIN';
       add_header X-Content-Type-Options 'nosniff';
       add_header X-Permitted-Cross-Domain-Policies 'none';
-      add_header X-XSS-Protection '1; mode=block';
+      add_header X-XSS-Protection '0';
       add_header Referrer-Policy 'same-origin';
 
       # mozilla autoconfiguration