X-XSS-Protection header doesnt have a semicolon in the end

[tlaanemaa]

When portainer is hosted behind another Nginx server that defines its own X-XSS-Protection header then those two headers get merged by in the browser (Chrome in my case). Since your version of the header doesnt have semicolon in the end it will cause an error and force Chrome to ignore both headers.

A good fix would be to add the semicolons so browsers can correctly parse duplicate headers.