Python : XSS protection is disabled

The X-XSS-Protection header is explicitly disabled which may increase the risk of cross-site scripting attacks.

The X-XSS-Protection refers to a header that is automatically enabled in Internet Explorer 8 upwards and the latest versions of Chrome. When the header value is set to false (0) cross-site scripting protection is disabled. The header can be set in multiple locations and should be checked for both misconfiguration as well as malicious tampering.

Mako is a Python templating system often used to build web applications. It is the default templating system used in Pylons and Pyramid.

Unlike Jinja2 (an alternative templating system), Mako has no environment wide variable escaping mechanism. Because of this, all input variables must be carefully escaped before use to prevent possible vulnerabilities to Cross Site Scripting (XSS) attacks.