Question about XSS protection for plugins

[Daisuke Niwa]

Hi there,

I have a question about "Anti XSS module for plugins" within the security configuration screen of Confluence admin console.

One customer reported that when they enable this, the amount of connection between Confluence and DB increased dramatically.

Does it correspond to XSSSecurityHeader added to xwork?

Also, anyone happens to know how this Anti XSS module works?

Regards,

Daisuke Niwa

[VitalyA · Accepted solution]

This is what you're looking for: https://developer.atlassian.com/display/CONFDEV/Enabling+XSS+Protection+in+Plugins

XSSSecurityHeader serves a different purpose and was introduced only recently.