OCI API Gateway drops X-XSS-Protection support - adding a Content-Security-Policy with header transformation policies

#What's changing

From the OCI service change announcements (announced 11 February 2026):

• API Gateway support for the X-XSS-Protection response header is deprecated.
• Effective date: 11 February 2027.
• Required action: make sure an appropriate Content-Security-Policy header is in place, served by the backend or added with a header transformation policy.

Modern browsers no longer act on X-XSS-Protection (the old XSS auditor was removed), and in some cases the header caused problems of its own. CSP is the current control.

#1. Find deployments that set the header

oci api-gateway deployment list --compartment-id $C --all \
  --query "data.items[].id" --raw-output | jq -r '.[]' |
while read id; do
  oci api-gateway deployment get --deployment-id "$id" > dep.json
  if grep -qi "x-xss-protection" dep.json; then
    jq -r '.data."display-name"' dep.json
  fi
done

Also check what clients actually receive:

curl -sI https://<gateway-host>/<path> | grep -iE "x-xss-protection|content-security-policy"

The header may come from the backend rather than the gateway. Fix it where it's set.

#2. Write a CSP that fits the API

For a JSON API that never serves HTML to browsers, a strict policy is safe:

Content-Security-Policy: default-src 'none'; frame-ancestors 'none'

For an endpoint that serves a web page (an SPA through the gateway, a login page), build the policy from what the page loads: scripts, styles, fonts, API calls. Start with Content-Security-Policy-Report-Only and a report-uri or report-to endpoint, watch the reports, then switch to enforcing.

#3. Set it with a response header transformation

In the deployment specification, per route:

{
  "path": "/orders",
  "methods": ["GET", "POST"],
  "backend": { "type": "HTTP_BACKEND", "url": "https://orders.internal.example.com" },
  "responsePolicies": {
    "headerTransformations": {
      "setHeaders": {
        "items": [
          { "name": "Content-Security-Policy",
            "values": ["default-src 'none'; frame-ancestors 'none'"],
            "ifExists": "OVERWRITE" }
        ]
      },
      "filterHeaders": {
        "type": "BLOCK",
        "items": [ { "name": "X-XSS-Protection" } ]
      }
    }
  }
}

Apply it:

oci api-gateway deployment update --deployment-id $DEP \
  --specification file://spec.json --force

Check the exact field names against the API Gateway documentation for your deployment format; the console's route editor (Response policies > Header transformations) creates the same structure if you'd rather click.

#4. Other headers worth setting at the same time

#5. Verify

curl -sI https://<gateway-host>/orders | grep -iE "content-security-policy|x-xss-protection|strict-transport"

The CSP should be present and X-XSS-Protection gone. For browser-facing routes, load the page with developer tools open and check for CSP violations.

#Checklist

• Deployments and backends that send X-XSS-Protection found
• CSP designed per route type (strict for JSON APIs, report-only first for pages)
• Header transformation policies applied
• X-XSS-Protection removed
• Other security headers reviewed
• Done well before 11 February 2027

#Sources

• OCI Service Change Announcements - API Gateway