Disable the X-XSS-Protection header in defaults #35

[mahsa2]

Disable the XSS Auditor in older browsers by default. The X-XSS-Protection header has been deprecated by modern browsers due to security issues it introduces on the client-side.

Resolves: #35

[mahsa2]

Thanks for the review. Submitted an update.

[weavejester]

That seems fine. Can you squash your two commits?

[weavejester]

Thanks! Apologies for the delay - GitHub doesn't always notify me about commit changes.

Can you change the commit message to:

Disable the X-XSS-Protection header in defaults

Disable the XSS Auditor in older browsers by default. The
X-XSS-Protection header has been deprecated by modern browsers due to
security issues it introduces on the client.

See: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#x-xss-protection-header

Fixes #35.

That just fixes the wrapping, and I tend to use 'Fixes' rather than 'Resolves' in the logs, so by making it consistent it's easier to search. Adding the URL gives some information on why the change was implemented.

[terop]

This PR could probably be closed as the change has been done in another PR.