From ead9115b6fc31406d557f5d80301f412e96e7260 Mon Sep 17 00:00:00 2001
From: Qiu Jian <qiujian@yunionyun.com>
Date: Wed, 19 Jan 2022 12:55:51 +0800
Subject: [PATCH] fix: add header x-xss-protection

---
 pkg/appsrv/appsrv.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/appsrv/appsrv.go b/pkg/appsrv/appsrv.go
index c1ddd05289..ba4a498bac 100644
--- a/pkg/appsrv/appsrv.go
+++ b/pkg/appsrv/appsrv.go
@@ -313,6 +313,7 @@ func (app *Application) defaultHandle(w http.ResponseWriter, r *http.Request, ri
 	params := make(map[string]string)
 	w.Header().Set("Server", "Yunion AppServer/Go/2018.4")
 	w.Header().Set("X-Frame-Options", "SAMEORIGIN")
+	w.Header().Set("X-XSS-Protection", "1; mode=block")
 	isCors := app.handleCORS(w, r)
 	handler := app.getRoot(r.Method).Match(segs, params)
 	if handler != nil {