Struct XXSSProtection

pub struct XXSSProtection { /* private fields */ }

Manages X-XSS-Protection header

The HTTP X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. Although these protections are largely unnecessary in modern browsers when sites implement a strong Content-Security-Policy that disables the use of inline JavaScript (‘unsafe-inline’), they can still provide protections for users of older web browsers that don’t yet support CSP.

Values

• 0: Disables XSS filtering.
• 1: Enables XSS filtering (usually default in browsers).
• 1; mode=block: Enables XSS filtering. Rather than sanitizing the page, the browser will prevent rendering of the page if an attack is detected.
• 1; report=: Enables XSS filtering. If a cross-site scripting attack is detected, the browser will sanitize the page and report the violation. This uses the functionality of the CSP report-uri directive to send a report.

Examples

use helmet_core::XXSSProtection;

let x_xss_protection = XXSSProtection::on();

let x_xss_protection = XXSSProtection::off();

let x_xss_protection = XXSSProtection::on().mode_block();

let x_xss_protection = XXSSProtection::on().report("https://example.com");

let x_xss_protection = XXSSProtection::on().mode_block().report("https://example.com");

Implementations

impl XXSSProtection

pub fn off() -> Self

Disables XSS filtering.

pub fn on() -> Self

Enables XSS filtering (usually default in browsers).

pub fn mode_block(self) -> Self

Enables XSS filtering. Rather than sanitizing the page, the browser will prevent rendering of the page if an attack is detected.

pub fn report(self, report: &str) -> Self

Enables XSS filtering. If a cross-site scripting attack is detected, the browser will sanitize the page and report the violation. This uses the functionality of the CSP report-uri directive to send a report.

Trait Implementations

impl Clone for XXSSProtection

fn clone(&self) -> XXSSProtection

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Display for XXSSProtection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Into<(&'static str, String)> for XXSSProtection

fn into(self) -> Header

Converts this type into the (usually inferred) input type.