nixos/grafana: don't set X-XSS-Protection anymore (#438903)

2025-09-01 10:40:34 -07:00
parent dd48dcf7d8 409107d2f5
commit 317f8e8763
1 changed files with 5 additions and 2 deletions
@@ -985,10 +985,13 @@ in

            x_xss_protection = mkOption {
              description = ''
-                Set to `false` to disable the `X-XSS-Protection` header,
+                Set to `true` to enable the `X-XSS-Protection` header,
                which tells browsers to stop pages from loading when they detect reflected cross-site scripting (XSS) attacks.
+
+                __Note:__ this is the default in Grafana, it's turned off here
+                since it's [recommended to not use this header anymore](https://owasp.org/www-project-secure-headers/#x-xss-protection).
              '';
-              default = true;
+              default = false;
              type = types.bool;
            };