Mailu generating two x-xss-protection headers

[sge1867]

A relatively out of the box configuration generates multiple x-xss headers:

x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block

I've checked to make sure this isn't cloudflare adding them by going directly to the server IP.

This is likely because both PHP and Nginx are setting this header.

Screenshot of issue:

[kaiyou]

This is rather surprising, I would think nginx was overwriting things. Will check if this has any impact and if it can be mitigated easily.

[Dennis14e]

I can confirm the behavior (rainloop webmail).
@kaiyou Is it possible to hide the "x-powered-by" header at the same time?

[bladeswords]

I have the same issue, running mailu 1.7 with rainloop as the webmail interface. I thought that nginx would strip/overwrite these headers?

[Nebukadneza]

Hi There,

The Mailu-Project is currently in a bit of a bind! We are short on man-power, and we need to judge if it is possible for us to put in some work on this issue.

To help with that, we are currently trying to find out which issues are actively keeping users from using Mailu, which issues have someone who want to work on them — and which issues may be less important. These a less important ones could be discarded for the time being, until the project is in a more stable and regular state once again.

In order for us to better assess this, it would be helpful if you could put a reaction on this post (use the :smiley: icon to the top-right).

• 👍️ if you need this to be able to use Mailu. Ideally, you’d also be able to test this on your installation, and provide feedback …
• 🎉 if you find it a nice bonus, but no deal-breaker
• 🚀 if you want to work on it yourself!
  We want to keep this voting open for 2 weeks from now, so please help out!

[bladeswords]

This should be good to do and issue closed :+1:

[Diman0]

Closing since fixed by PR #1181 . Thank you for creating the PR and reporting the issue.