remove deprecated X-XSS-Protection header

Only legacy browsers are still supporting this header. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection#browser_compatibility.
owncloud · Oct 21, 2021 · a1fd243 · a1fd243
1 parent ab163ba
commit a1fd243
Showing 1 changed file with 0 additions and 1 deletion.
diff --git a/ocis-pkg/middleware/header.go b/ocis-pkg/middleware/header.go
@@ -38,7 +38,6 @@ func Secure(next http.Handler) http.Handler {
 		w.Header().Set("Access-Control-Allow-Origin", "*")
 		w.Header().Set("X-Frame-Options", "DENY")
 		w.Header().Set("X-Content-Type-Options", "nosniff")
-		w.Header().Set("X-XSS-Protection", "1; mode=block")
 
 		if r.TLS != nil {
 			w.Header().Set("Strict-Transport-Security", "max-age=31536000")