为什么我设置 res.set('X-XSS-Protection',0);不起作用？
<img src="null" onerror="alert"1"/>依旧被浏览器屏蔽
router.get('/', function(req, res, next) {
// 阻止浏览器的XSS拦截
res.set('X-XSS-Protection',0);
res.render('index', { title: 'Express', xss:req.query.xss});
});
控制台错误信息：
localhost/:11 The XSS Auditor refused to execute a script in 'http://localhost:3000/?xss=%3Cimg%20src=%22null%22%20onerror=%22alert(1)%22/%3E' because its source code was found within the request. The auditor was enabled as the server did not send an 'X-XSS-Protection' header.
?xss=<img src="null" onerror="alert(1)"/>:11 GET http://localhost:3000/null 404 (Not Found)
