bkkvbu: disable X-XSS-Protection (set via application)

diff --git a/customer/bkk-vbu/dev-web01-meine-krankenkasse-de.pixelpark.net.yaml b/customer/bkk-vbu/dev-web01-meine-krankenkasse-de.pixelpark.net.yaml
index 2131bd36aadddbb39533d2972b93fe20d7d2b1ad..ea097d4951b2c44b5f733d11843d3e1d86975783 100644 (file)
--- a/customer/bkk-vbu/dev-web01-meine-krankenkasse-de.pixelpark.net.yaml
+++ b/customer/bkk-vbu/dev-web01-meine-krankenkasse-de.pixelpark.net.yaml
@@ -43,7 +43,8 @@ infra::profile::apache::pp_vhosts:
     headers:
       - 'always unset "X-Powered-By"'
       - 'set X-Content-Type-Options: nosniff'
-      - 'set X-XSS-Protection: "1; mode=block"'
+      # X-XSS-Protection set by helmetjs (https://helmetjs.github.io/)
+      # - 'set X-XSS-Protection: "1; mode=block"'
       - 'set X-Frame-Options: "ALLOW-FROM https://dev-cms01-meine-krankenkasse-de.pixelpark.net"'
       - "set Content-Security-Policy: \"default-src 'self'; img-src 'self' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com data:; font-src 'self' bkk-vorteilsrechner.de; style-src 'self' 'unsafe-inline' bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com; script-src 'self' 'unsafe-inline' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com; child-src 'self' bkk-vorteilsrechner.de www.youtube-nocookie.com player.vimeo.com; frame-ancestors 'self'\""
       - "set X-Content-Security-Policy: \"default-src 'self'; img-src 'self' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com data:; font-src 'self' bkk-vorteilsrechner.de; style-src 'self' 'unsafe-inline' bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com; script-src 'self' 'unsafe-inline' webstats.pixelpark.com bkk-vorteilsrechner.de s.ytimg.com f.vimeocdn.com; child-src 'self' bkk-vorteilsrechner.de www.youtube-nocookie.com player.vimeo.com; frame-ancestors 'self'\""