Registry / http-networking / x-xss-protection

x-xss-protection

JSON →
library2.0.0jsnpmunverified

This package provides an Express middleware specifically designed to disable the `X-XSS-Protection` HTTP header by setting its value to `0`. This header, once intended to mitigate cross-site scripting (XSS) attacks, has been largely deprecated by browser vendors due to its propensity to introduce new security vulnerabilities rather than solve them. It is part of the Helmet.js project, a collection of middlewares for securing Express apps. The current stable version is 2.0.0. The package maintains a low release cadence, primarily updating for Node.js compatibility or critical bug fixes, as its core functionality (disabling a header) is stable and intentionally minimal. Its key differentiator is its explicit recommendation and implementation for removing a problematic legacy security feature, contrasting with older practices that advocated its use. This library is a targeted solution for modern web security practices, where XSS mitigation is handled by Content Security Policy (CSP) and robust input sanitization instead of this unreliable header.

http-networkingauth-securityweb-framework
npm install x-xss-protection
github ↗package ↗homepage ↗
INSTALL
IMPORT
SIG · X-XSS-PROTECTION
X
x-xss-protection
http-networkingjavascriptv2.0.0
Install
—
Import
—
Disk
—
Pass rate
0/ 6
Env Coverage0 / 6
glibc
18–22
musl
18–22
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18–226 runs
build_error
glibc
node 18–226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

Default exported middleware function (ESM)
✓ import xXssProtection from 'x-xss-protection';
✗ import { xXssProtection } from 'x-xss-protection';
The package exports a default function which returns an Express middleware. This is the standard ESM import for direct usage.
Default exported middleware function (CommonJS)
✓ const xXssProtection = require('x-xss-protection');
✗ const { xXssProtection } = require('x-xss-protection');
When using CommonJS, the `require` call directly resolves to the default exported middleware function.
Namespace import (ESM)
✓
✗ import * as xXssProtection from 'x-xss-protection';
While `import * as xXssProtection from 'x-xss-protection'` can be used, `xXssProtection` will then be an object `{ default: Function }`. To use the middleware, you would need to call `xXssProtection.default()`, which is less ergonomic than a direct default import.

Demonstrates how to integrate the middleware into an Express application to disable the X-XSS-Protection header.

const express = require('express'); const xXssProtection = require('x-xss-protection'); const app = express(); // Set "X-XSS-Protection: 0" app.use(xXssProtection()); app.get('/', (req, res) => { res.send('X-XSS-Protection header is set to 0'); }); const PORT = process.env.PORT ?? 3000; app.listen(PORT, () => { console.log(`Server running on http://localhost:${PORT}`); });
Debug
Known issues
breakingUsing the `X-XSS-Protection` header (even with `1; mode=block`) is generally insecure and deprecated by modern browsers, as it can introduce new vulnerabilities like Content Security Policy (CSP) bypasses or arbitrary script execution.
fix
Always disable the header using this middleware (`xXssProtection()`), or implement a robust Content Security Policy (CSP) and proper input sanitization instead.
affects: *
gotchaThis middleware specifically sets the `X-XSS-Protection` header to `0`, effectively disabling it. It does not provide any options to enable or configure its behavior to `1; mode=block` or similar legacy settings.
fix
If legacy `X-XSS-Protection` behavior is absolutely required (which is generally not recommended due to severe security risks), implement custom middleware to set the header manually.
affects: >=1.0.0
gotchaThis module's functionality (disabling the `X-XSS-Protection` header) is now the default behavior in Helmet.js versions 6 and above. If you are using a modern version of Helmet, this specific middleware is likely redundant.
fix
Review your Helmet.js configuration. If using Helmet v6+, this package is likely unnecessary. For older Helmet versions or standalone use, continue using this middleware as intended.
affects: >=1.0.0
Errors
Common errors & fixes
TypeError: xXssProtection is not a function
Attempting to call a named import as a function when the package exports a default function, or calling `xXssProtection` when using a namespace import without accessing `.default`.
fix
Use `import xXssProtection from 'x-xss-protection'` for ESM or `const xXssProtection = require('x-xss-protection')` for CommonJS.
ReferenceError: xXssProtection is not defined
Forgetting to import or require the package before attempting to use the `xXssProtection` function.
fix
Add `const xXssProtection = require('x-xss-protection')` or `import xXssProtection from 'x-xss-protection'` at the top of your file.
Upgrade
Version history
2.0.0latest on npm
Audit
Dependencies

No dependency data recorded yet.

Agent activity
37 hits · last 30 days
node
32
OpenAI (training)
1
Resources
githubhttps://github.com/helmetjs/helmet ↗
packagehttps://www.npmjs.com/package/x-xss-protection ↗
homepagehttps://helmetjs.github.io/ ↗
x-xss-protection — npm install x-xss-protection · libregistry