How to set caddy file to remove error 2FA Connector calls: Header: 'x-xss-protection' does not contain '0'

[Opicka879]

Hi,

can you give me an advice how to set up caddyfile to remove error 2FA Connector calls: Header: 'x-xss-protection' does not contain '0'? It appeared in diagnostic page of administration after last update to 1.32.6.

I have there:

header * {
		Strict-Transport-Security "max-age=31536000;"
		X-Robots-Tag "noindex, nofollow"
		server "My server name"
		X-XSS-Protection "0"
	}

[BlackDex]

Yea, remove the quotes.

[BlackDex]

For all calls to Vaultwarden you should not provide most security headers, except for the Strict-Transport-Security which is something you should determine your self of course.

All others should be removed and handled by Vaultwarden.
You could also check via the Developer Console (F12) of your browser what the headers are there.
It might shine a light on why this is reported. It might also be i need to make some adjustments to the check.

[Opicka879]

For all calls to Vaultwarden you should not provide most security headers, except for the Strict-Transport-Security which is something you should determine your self of course.

All others should be removed and handled by Vaultwarden. You could also check via the Developer Console (F12) of your browser what the headers are there. It might shine a light on why this is reported. It might also be i need to make some adjustments to the check.

I am sending my http head. I dont see there anything wrong but administration still shows that 2FA error.

C:\Users\******>curl -I https://*****.****.cz/
HTTP/1.1 200 OK
Alt-Svc: h3=":443"; ma=2592000
Cache-Control: no-cache, no-store, max-age=0
Content-Length: 0
Content-Security-Policy: default-src 'self'; base-uri 'self'; form-action 'self'; object-src 'self' blob:; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://* ; img-src 'self' data: https://haveibeenpwned.com ; connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory https://app.simplelogin.io/api/ https://app.addy.io/api/ https://api.fastmail.com/ https://api.forwardemail.net ;
Date: Thu, 12 Dec 2024 16:51:41 GMT
Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()
Referrer-Policy: same-origin
Server: **** *****
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: noindex, nofollow
X-Xss-Protection: 0

[BlackDex]

Strange, ill check what i see if i do the same in a few

[BlackDex]

Also, headers should not use capitals, but that shouldn't cause issues as far as i know.
Even Rocket sends those headers all in lowercase.

[BlackDex]

Ow, and you said it was gone for the API right? But still there for 2FA.
Then try this:

curl -I https://your.domain.tld/webauthn-connector.html

[BlackDex]

Also which browser and version are you using?

[Opicka879]

Ow, and you said it was gone for the API right? But still there for 2FA.
Then try this:

C:\Users\******>curl -I https://*****.****.**/webauthn-connector.html
HTTP/1.1 200 OK
Alt-Svc: h3=":443"; ma=2592000
Cache-Control: public, immutable, max-age=604800
Content-Length: 596
Content-Type: text/html; charset=utf-8
Date: Thu, 12 Dec 2024 21:44:48 GMT
Expires: Thu, 19 Dec 2024 21:44:48 GMT
Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()
Referrer-Policy: same-origin
Server: **** *****
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-Xss-Protection: 0

Also which browser and version are you using?
Vivaldi 7.0.3495.23 (Stable channel) (64bit)

But a strange thing happened. I made some changes in docker-compose.yml and i had to rebuild the container again like many times before and after hard refresh (CTRL+F5) the error has disappeared. I have no explanation for this behavior becouse i did not do any extra steps.