Question about sec-ch-ua HTTP header being flag as possible XSS

tCell
#1

Wanted to ask a question. We are getting a lot of App Firewall events where it looks like Chrome is injecting a new HTTP header named “sec-ch-ua” with a value of

“\Not;A"Brand”;v=“99”, “Google Chrome”;v=“85”, “Chromium”;v=“85”

This event looks innocuous. I did some research and below are a few articles on the header.


https://www.chromestatus.com/feature/5995832180473856

Are these events harmless, and if so, can we configure our applications to ignore the.

#2

Hey Eric!

Yes, this event is harmless and safe to ignore. We also do have an item in our backlog to include a filter to automatically ignore these (related to the changes that you’ve outlined above regarding the sec-* headers).

2 Likes
#3

Hello. Quick question. Have you all made any progress on filtering these items out. They are causing us to get alerts on legitimate traffic.

#4

Hey Eric! We actually pushed out a blanket policy to ignore sec-ch-ua header matching tc-xss4 pattern last night…let me know how it goes!

#5

I have confirmed that the rule is in place. Thanks @bria_grangard

1 Like