X-Xss-Protection disabled?

[fa-ve]

Is there a reason that X-Xss-Protection is disabled:

X-Xss-Protection
This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari (Webkit). Valid settings for the header are 0, which disables the protection, 1 which enables the protection and 1; mode=block which tells the browser to block the response if it detects an attack rather than sanitising the script.

As I get the following message, and I see 0 in the reporting.

https://securityheaders.com/?q=https%3A%2F%2Fzoeyvid.de%2F&followRedirects=on

[Zoey2936]

see here; https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

[fa-ve]

interesting as Nextcloud is reporting this in the security & setup scan, guess they should remove it if it's not needed.

[Zoey2936]

see here: nextcloud/server#37154

[fa-ve]

thanks for your very fast replies, added a comment to that report.