title: How to deal with Chrome X-XSS-Protection in a right way?
body: <p>I run my application in Chrome, it has a error:</p>
  
  <pre><code>Refused to execute script from 'http://example.com/info?no=31&amp;magic=1184' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled. 
  </code></pre>
  
  <p>From this topic, I know it should to set http header X-XSS-Protection : 0</p>
  
  <p><a href="https://stackoverflow.com/questions/1547884/refused-to-execute-a-javascript-script-source-code-of-script-found-within-reque">Refused to execute a JavaScript script. Source code of script found within request</a></p>
  
  <p>I use RoR to set it as this:</p>
  
  <pre><code>def info
    response.headers['X-XSS-Protection'] = '0'
    # Other logic
  end
  </code></pre>
  
  <p>But the result is,the http header still:</p>
  
  <pre><code>X-XSS-Protection:1; mode=block
  X-XSS-Protection:0
  </code></pre>
  
  <hr>
  
  <p>When I try it in Firefox, the http header is:</p>
  
  <pre><code>X-XSS-Protection    0, 1; mode=block
  </code></pre>
  
  <p>And can run perfectly.</p>
  
  <p>Why it has <code>1; mode=block</code>? How to remove it?</p>