title: Chrome Developer Console throws X-XSS-Protection error when embedding youtube link
body: <p>I'm using Chrome Version 31.0.1650.63 m.</p>
  
  <p>Recently, I've noticed a few errors being thrown in the Chrome developer console, but nothing seems wrong with my site. Upon investigation, they seem to be related to an embedded youtube link. The markup in question is as follows:</p>
  
  <pre><code>&lt;iframe width="560" height="315" src="http://www.youtube.com/embed/hhhrWFxWQRk" frameborder="0" allowfullscreen&gt;&lt;/iframe&gt;
  </code></pre>
  
  <p>The video itself is irrelevant (I just grabbed the first one I saw on youtubes front page as a test), but I've included the link I'm using here in case something very specific is happening.</p>
  
  <p>The response headers from the request made in Chrome are as follows:</p>
  
  <pre><code>Alternate-Protocol:80:quic
  Cache-Control:no-cache
  Content-Encoding:gzip
  Content-Length:2560
  Content-Type:text/html; charset=utf-8
  Date:Sun, 12 Jan 2014 20:35:54 GMT
  Expires:Tue, 27 Apr 1971 19:44:06 EST
  Server:gwiseguy/2.0
  X-Content-Type-Options:nosniff
  X-Frame-Options:ALLOWALL
  X-XSS-Protection:1; mode=block; report=https://www.google.com/appserve/security-bugs/log/youtube
  </code></pre>
  
  <p>And the errors I'm getting in the Chrome developer console are as follows:</p>
  
  <pre><code>Invalid 'X-Frame-Options' header encountered when loading 'http://www.youtube.com/embed/hhhrWFxWQRk': 'sil' is not a recognized directive. The header will be ignored.
  Error parsing header X-XSS-Protection: sil: expected 0 or 1 at character position 0. The default protections will be applied. 
  </code></pre>
  
  <p>In big red letters. The first thing I notice is that the errors both reference the value "sil", which I don't see in any of the response headers for HTTP request.</p>
  
  <p>The video displays and plays fine, and the errors say that default settings will be used - so this doesn't look like an issue. However, I'm keen to understand what's going on, and why these errors are occurring.</p>
  
  <p>I notice that the errors relate to XSS, and from my research, I think the <a href="https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection">X-XSS-Protection header is for IE8 only</a>, and the value being returned from YouTube is invalid (report= et al). The X-Frame-Options header's value seems to be <a href="https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options" rel="noreferrer">invalid</a> according to the specification, but <a href="http://en.wikipedia.org/wiki/Clickjacking" rel="noreferrer">Wikipedia</a> (I know!) references the ALLOWALL option:</p>
  
  <blockquote>
    <p>In addition to that, some advertising sites return a non-standard
    ALLOWALL value with the intention to allow framing their content on
    any page (equivalent of not setting X-Frame-Options at all).[31]</p>
  </blockquote>
  
  <p>Is this a valid concern? Is this a Chrome parsing error, an issue with youtube's headers, or am I completely missing the point?</p>
  
  <p>I have also done some testing in Firefox v26, IE 11.0.6600.16476, and Opera 12.16, and none of those browsers produce this error.</p>