Setting X-XSS-Protection: 1 in response header by default?

[pythonissam]

I suggest setting X-XSS-Protection: 1 in HTTP response header by default. With this setting, Yesod can force browsers to enable XSS filtering. I think it allows us to enforce Yesod's security.

Putting addHeader into defaultYesodMiddleware or modifying stack-template would work.

[MaxGabriel]

My understanding is that 1 is the default for all browsers that support it. Though there's a case to be made for using 1; mode=block instead

https://blog.innerht.ml/the-misunderstood-x-xss-protection/
https://markitzeroday.com/headers/content-security-policy/2018/02/10/x-xss-protection.html

[pythonissam]

Ah, you're right! Yes, 1; mode=block is what i meant. haha

[StevenXL]

Addressed by #1550.