I developed a Visualforce page with an integration that visualizes a Google Map, but when the page is opened, in the console browser I can see the errors:

-Unrecognized Content-Security-Policy directive 'reflected-xss'.
-Refused to set unsafe header "User-Agent"
-Unrecognized Content-Security-Policy directive 'referrer'.

What is causing this message?

2 Answers 2


These are harmless messages, caused by deprecated CSP directives ('reflected-css' and 'referrer'), as well as an anti-spoofing message ('Refused to set unsafe header'). None of these three messages impact script functionality or resource acquisition. If you're having a problem with your code, these messages are not the cause. You can search your favorite search engine for more details on these messages.


The reflected-xss support was removed from Chrome https://bugs.chromium.org/p/chromium/issues/detail?id=657737&can=1&q=reflected-xss&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified

  • Can edit your answer to add some detail about how this change is relevant to the question?
    – Adrian Larson
    Mar 31, 2017 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.