Scholarlink

<p>In this article we report on a post-mortem analysis of the X-XSS-Protection header. Our analysis used data from header usage in the wild at the time of its death as judged by the Google Chrome deprecation notice. We processed roughly 2.6 billion HTTP responses and classified them not just by validity or invalidity but by the reasons for each. We created a set of regex-driven attributions (RDAs) to support robust classification. We found great security posture with minimum levels of disablement and a strong preference for additional protections. Unfortunately, we also discovered that misconfigurations often resulted in dangerous situations with potentially less than the expressly desired level of security. Our results have implications for the potential reconsideration of what a browser should consider a fail-safe design, the opportunity to design new mechanisms with security configuration gradients, and motivation that solving just a few errors can make an enormous impact at internet scale. Finally, this article motivates the security community to consider conducting additional post-mortem analysis in a variety of contexts besides the deprecated HTTP header presented here.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

The Death of the X-XSS-Protection Header: A Web Security Post-Mortem

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年1月1日

查看全文
  • Andrew Besmer,
  • Jason Watson,
  • David Scibelli

摘要

In this article we report on a post-mortem analysis of the X-XSS-Protection header. Our analysis used data from header usage in the wild at the time of its death as judged by the Google Chrome deprecation notice. We processed roughly 2.6 billion HTTP responses and classified them not just by validity or invalidity but by the reasons for each. We created a set of regex-driven attributions (RDAs) to support robust classification. We found great security posture with minimum levels of disablement and a strong preference for additional protections. Unfortunately, we also discovered that misconfigurations often resulted in dangerous situations with potentially less than the expressly desired level of security. Our results have implications for the potential reconsideration of what a browser should consider a fail-safe design, the opportunity to design new mechanisms with security configuration gradients, and motivation that solving just a few errors can make an enormous impact at internet scale. Finally, this article motivates the security community to consider conducting additional post-mortem analysis in a variety of contexts besides the deprecated HTTP header presented here.