Deprecation notice for the `x_xss_protection` configuration option

What is changing

Grafana is deprecating the [security] x_xss_protection setting. When the release containing this change reaches your self-managed instance, Grafana logs a deprecation warning on startup if the setting is enabled. Its default is true, so the warning can appear even if you have not set the option explicitly.

The setting still works in this release. With x_xss_protection = true, Grafana continues to send the X-XSS-Protection response header. With x_xss_protection = false, it continues to omit that header. We will remove the setting in a future major release, but no removal version or date has been set.

Why we’re changing it

The X-XSS-Protection header is deprecated in modern browsers and can cause security problems in some cases. A Content Security Policy (CSP) is the recommended way to control which content a browser can load and to help mitigate cross-site scripting (XSS).

What is not changing

This deprecation does not remove the setting or change its default or current header behavior. The warning does not mean your instance has stopped working. Other security settings and the Grafana interface are unchanged.

What to check before this rolls out

• If you manage a self-managed instance, check whether [security] x_xss_protection or GF_SECURITY_X_XSS_PROTECTION is set in your Grafana configuration file, either custom.ini or grafana.ini. If it is unset, the default is true and the warning will appear after this change reaches your instance. No immediate configuration change is required to keep the current behavior.
• If you want to stop relying on this header, test CSP first with [security] content_security_policy_report_only = true. After checking the policy’s effect on your dashboards and plugins, enable it with [security] content_security_policy = true, then set [security] x_xss_protection = false. See Configure security hardening for the CSP configuration.
• If you intentionally keep x_xss_protection = true for older browsers, you can leave it enabled for now. Plan to move away from the setting before its future removal. Grafana will announce the removal timing separately.