Disable XSS-Protection Header

see notes: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

Signed-off-by: Maru Alka <[email protected]>

Author: minecrawler

admin_manual/installation/nginx-root.conf.sample

@@ -79,7 +79,6 @@ server {
     add_header X-Frame-Options                   "SAMEORIGIN"        always;
     add_header X-Permitted-Cross-Domain-Policies "none"              always;
     add_header X-Robots-Tag                      "noindex, nofollow" always;
-    add_header X-XSS-Protection                  "1; mode=block"     always;
 
     # Remove X-Powered-By, which is an information leak
     fastcgi_hide_header X-Powered-By;

admin_manual/installation/nginx-subdir.conf.sample

@@ -111,7 +111,6 @@ server {
         add_header X-Frame-Options                   "SAMEORIGIN"        always;
         add_header X-Permitted-Cross-Domain-Policies "none"              always;
         add_header X-Robots-Tag                      "noindex, nofollow" always;
-        add_header X-XSS-Protection                  "1; mode=block"     always;
 
         # Remove X-Powered-By, which is an information leak
         fastcgi_hide_header X-Powered-By;