Hi all,
Today we received the results of a security assessment of our application, and concerns were raised about Auth0’s universal login (via custom and default domain) setting the value of the X-XSS-Protection header to 1 instead of the recommended value of 0. We would recommend that this either be changed or an option be given to allow this to be configured.
As links are disabled, sources can be found on Mozilla’s developer docs, OWASP’s cheatsheets series, and some articles by searching “x-xss-protection 0”.