From 3232ea455262c127dfc5d5eaca7dd7d5abf91b4d Mon Sep 17 00:00:00 2001 From: Yann Verry Date: Mon, 17 Jun 2019 23:46:35 +0200 Subject: [PATCH] HTTPServer: Fix X-XSS-Protection header formatting (#17620) Fixes #17619 (cherry picked from commit ed613194ac7423c4a307ef1efbe54fbfd8165f10) --- pkg/middleware/middleware.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pkg/middleware/middleware.go b/pkg/middleware/middleware.go index 2111a063b7d..ebdc5ab8a85 100644 --- a/pkg/middleware/middleware.go +++ b/pkg/middleware/middleware.go @@ -266,8 +266,7 @@ func AddSecurityHeaders(w macaron.ResponseWriter) { } if setting.XSSProtectionHeader { - w.Header().Add("X-XSS-Protection", "1") - w.Header().Add("X-XSS-Protection", "mode=block") + w.Header().Add("X-XSS-Protection", "1; mode=block") } }