XssProtection.php

Go to the documentation of this file.

<?php
namespace Magento\Framework\App\Response\HeaderProvider;

use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
use Magento\Framework\HTTP\Header;

class XssProtection extends AbstractHeaderProvider
{
    protected $headerName = 'X-XSS-Protection';

    const IE_8_USER_AGENT = 'MSIE 8';

    const HEADER_ENABLED = '1; mode=block';

    const HEADER_DISABLED = '0';

    private $headerService;

    public function __construct(Header $headerService)
    {
        $this->headerService = $headerService;
    }

    public function getValue()
    {
        return strpos($this->headerService->getHttpUserAgent(), self::IE_8_USER_AGENT) === false
            ? self::HEADER_ENABLED
            : self::HEADER_DISABLED;
    }
}