Investigate setting X-XSS-Protection header.
Seems like we should figure out if we want it, and if so set to block. If we don't want, we should maybe consider disabling entirely.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Declined | None | T165455 Go from "E" to "A+" on Securityheaders.io | |||
| Open | None | T182535 Investigate maybe setting X-XSS-Protection header |