Myth-Busting SOP: 'CSP Is Too Hard, X-XSS-Protection Is Enough'

Myth-Busting SOP: 'CSP Is Too Hard, X-XSS-Protection Is Enough'

X-XSS-Protection is deprecated and removed from modern browsers — it does nothing now. Content-Security-Policy is the real XSS control, and you can roll it out safely. Procedure:

— Step 1: Delete X-XSS-Protection; it's dead weight and can introduce bugs.
— Step 2: Deploy CSP in report-only first: Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-log.
— Step 3: Collect violations for a week, then allowlist the legitimate sources you find.
— Step 4: Promote to enforcing mode; avoid 'unsafe-inline' by using nonces.
— Step 5: Verify on securityheaders.com — aim for an A, and confirm inline-script injection is blocked.

Report-only mode removes the excuse. Run this every time.