解析标头 X-XSS-Protection 时出错 - Google Chrome

问题描述

我在 Windows 10 机器上将 Google Chrome 升级到 版本 64.0.3282.140(官方构建)(64 位).完成后，我在开发人员工具控制台中的网站上收到此错误.不确定从哪里开始.去年我确实看到了类似的问题，这是 youtube 的问题(也在 url 中)，但我还没有看到任何解决方案.

I upgraded Google Chrome to Version 64.0.3282.140 (Official Build) (64-bit) on a Windows 10 machine. Once I did, I am getting this error on my site within the developer tools console. Not real sure where to start. I did see a similar issue last year that was an issue with youtube (also in the url), but I haven't seen any solutions.

Error parsing header X-XSS-Protection: 1; mode=block; 
report=https://www.google.com/appserve/security-bugs/log/youtube: insecure 
reporting URL for secure page at character position 22. The default 
protections will be applied.
16:07:31.905

当我通过嵌入式 url 直接访问 youtube 时，我也看到了这个问题，所以它不仅仅是在我的网站上.

I'm also seeing the issue when I go directly to youtube via the embedded url so it's not just on my site.

更新

我在响应中附上了一张标题的照片，表明似乎正在产生问题的 google.com 网址.

I've attached a photo of the headers in the response that indicate the google.com url that appears to be generating the issue.

推荐答案

这是当前 Google Chrome 和 Chromium 中的一个已知错误:
https://bugs.chromium.org/p/chromium/issues/detail?id=807304

It's a known bug in the current Google Chrome and Chromium:
https://bugs.chromium.org/p/chromium/issues/detail?id=807304

在当前版本的浏览器中，出于某些安全原因，Chrome 开发人员已将 X-XSS-Protection 的报告字段 URL 限制为相同的域来源.因此，当您使用一些嵌入代码嵌入视频时，它会从另一台服务器下载，其中标题为report=https://www.google.com/" 已设置，并且当您的页面未托管在 google.com 域中时 - 会出现错误消息.

In the current version of their browser, the Chrome developers had restricted the X-XSS-Protection's report field URL to the same domain origin for some security reasons. So, when you embed a video with some embed code, as it downloads from another server where the header "report=https://www.google.com/" is set, and while your page is not hosted at the google.com domain - the error message occurs.

然而，所有小型网站(包括 youtube.com)都在发送包含不同来源域的报告 URL.很可能，他们甚至不知道 Chrome 最近的这种变化.因此，要么 YouTube 将更改其标题，要么 Chrome 开发人员将其还原.作为最终用户，我们无能为力.等他们解决这个问题.

Yet, all minor sites (including youtube.com) are sending report URL with different origin domains in it. Probably, they are not even aware of this recent change in Chrome. So either YouTube will change their headers or Chrome developers will revert this. There's nothing that we, as end users, can do. Just wait till they sort this out.

更新:

该问题已在版本 66.0.3359.117(官方构建)(64 位)中修复

这篇关于解析标头 X-XSS-Protection 时出错 - Google Chrome的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持跟版网！