5

I have enabled XSS protection and Content Sniffing protection in sandbox.

How can I test these security features in salesforce whether my org is XSS and content sniffing protected?

I have enabled them by using:

Quick find box > session settings> XSS protection/Content Sniffing protection

1 Answer 1

3

According to Platform Security FAQS.

X-Content-Type-Options: no sniff

The HTTP header can be turned on or off by each organization under Setup > Security Controls > Session Settings > Enable Content Sniffing Protection.
Browsers may ignore the Content-Type header returned by the server and guess the content-type from the actual content of the body response. This can be leveraged to force the browser to execute malicious Javascript or CSS.
The HTTP header X-Content-Type-Options: nosniff prevents the browser from guessing the type of file based on its content or the embedding tag. The browser obeys the content-type sent by the server.

X-XSS-Protection

The HTTP header can be turned on or off by each organization under Setup > Security Controls > Session Settings > Enable XSS Protection.
This header prevents some Reflected Cross-Site Scripting attacks. It works with the same way as the CSP directive reflected-XSS.
If the browser detects a reflected XSS, it will block the content and show a blank page instead.

So to test them I'd use something like the Chrome browsers developer tools Network tab to inspect the response headers that are coming back from each page in Salesforce. You are looking for the X-Content-Type-Options and X-XSS-Protection headers in the response.

enter image description here


Note from the same reference on the XSS Protection Headers (my emphasis).

We do not consider the browser level XSS protections as adequate to properly secure against XSS. Different browsers have different ways of handling/parsing HTML and Javascript and the protections behave differently across browsers. We consider it imperative to implement XSS protections on the application and be as browser agnostic as possible.

3
  • @Daniel-I checked for two sandbox i.e one sandbox with enabled XSS protection and content sniffing protection enabled using Setup > Security Controls > Session Settings and another sandbox without enabled and in both case it is showing me X-Content-Type-Options:nosniff X-XSS-Protection:1; mode=block. It should actually show me above result only for 1 sandbox which is enabled right ??
    – Jack vardy
    Mar 14, 2017 at 7:33
  • @Jackvardy It might depend on the page you are requesting from Salesforce as to where that setting takes affect. Try, for instance, a Visualforce page. Mar 15, 2017 at 0:04
  • @Daniel-I tried using fiddler software and there i can see for homepage i can see proper result.
    – Jack vardy
    Mar 15, 2017 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.