[
https://issues.apache.org/jira/browse/ATLAS-5160?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123671#comment-18123671
]
ASF subversion and git services commented on ATLAS-5160:
--------------------------------------------------------
Commit bc3c272e89d7ce6a01b71a8b57250eb4b4e48b55 in atlas's branch
refs/heads/ATLAS-4796_u from pareshd
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=bc3c272e8 ]
ATLAS-5160: Remove deprecated X-XSS-Protection response header (#774)
Stop sending X-XSS-Protection from default HTTP headers and disable Spring
Security's XSS protection header in favor of Content-Security-Policy.
Co-authored-by: Paresh Devalia <[email protected]>
> Remove deprecated X-XSS-PROTECTION header from HTTP response headers
> initialization and Atlas Spring Security Config
> --------------------------------------------------------------------------------------------------------------------
>
> Key: ATLAS-5160
> URL: https://issues.apache.org/jira/browse/ATLAS-5160
> Project: Atlas
> Issue Type: Improvement
> Components: atlas-core
> Reporter: Aditya Gupta
> Assignee: Paresh Devalia
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 1h
> Remaining Estimate: 0h
>
> One of the headers included is X-XSS-PROTECTION, which is now deprecated and
> no longer supported by modern browsers.
> * Remove the X-XSS-PROTECTION response header
> * Remove related constants ({{{}X_XSS_PROTECTION_KEY{}}},
> {{{}X_XSS_PROTECTION_VAL{}}}) if no longer referenced
> * Update tests (including {{{}HeadersUtilTest, AtlasSecurityConfigTest{}}})
> accordingly
> h3. Expected Outcome
> * Atlas no longer sends deprecated headers
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
