43

How to fix this error in console?

Error parsing header X-XSS-Protection: 1; mode=block, 1;
mode=block:expected semicolon at character position 14.
The default protections will be applied.
0

6 Answers 6

47

If the error is shown even you send the right header, check if you send the header perhaps twice. This is shown in the error-console below network and you click on any file.

Sending the header twice can happen if for the server

add_header X-XSS-Protection "1; mode=block";

is noted in two different include-files or one include-file is included twice. Browsers or at least chrome is concatenating the two headers then internally and the applied WRONG rule is then, like shown in the question:

X-XSS-Protection: "1; mode=block, 1; mode=block"
3
  • 2
    and this was the answer to me, i have added it in my .htaccess, and i have also a line in my php code header( x-xss-Protection); , iremove the line from php, Thanks @david
    – bdalina
    Oct 8, 2017 at 14:15
  • 1
    Exactly the issue for me. also solved Mozilla Observatory not detecting the header. Particularly the always keyword in this apache conf line Header always set X-Content-Type-Options "nosniff"
    – bbeecher
    Nov 6, 2017 at 5:26
  • 2
    was definitely adding headers twice. Once via nginx & second time via express helmet. Removed express helmet setting headers and all was fixed. Thank you for the pointer!
    – Ash
    Mar 30, 2019 at 22:09
5

I had the same error in Chrome. I was adding the header to multiple sites.

Instead, you should add it to the http block if you are using NGINX:

http {
    add_header X-XSS-Protection "1; mode=block";

    ...
}
0
4

I had this error when I’m proxying a Docker service through NGINX. Both the Docker service and NGINX adds the header, so I need to dedupe. I finally came out with this:

map $upstream_http_x_xss_protection $xss_p {
    '' '1; mode=block';
}
add_header X-XSS-Protection $xss_p always;

I call this “poor man’s set_header”. Thanks to great hint from David and kolbyjack.

2

If you are using Akamai use "modify" instead of "add" behavior in your configuration. Make sure you have selected the "avoid duplicate headers" option, which is only available in "modify" modus.

1

You are not following the proper syntax of X-XSS-Protection, so you are getting a parsing error.

I think you are looking for this:

X-XSS-Protection: 1; mode=block

So remove the , 1 at the end of yours

1
  • 1
    That is the error code, the correct syntax: add_header X-XSS-Protection: "1; mode=block"; is causing this. Jul 22, 2016 at 5:20
1

If you are dealing with a load balancer, don't put the extra headers on the load balancer. The headers will get populated and passed up from the servers through the load balancer. Putting it on both causes duplicate headers and causes this error.

Not the answer you're looking for? Browse other questions tagged or ask your own question.