prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Send X-XSS-Protection header
  The X-XSS-Protection header can be used to manage certain browser's protection against reflected cross-site scripting (XSS), stopping a page from being loaded if an attack is detected. In modern browsers, the Content-Security-Policy header can provide better protection against XSS and setting X-XSS-Protection might be redundant (#203 tracks CSP implementation).
  
  See more at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
  
  
  We'll want the following header/value:
  
  ```
  X-XSS-Protection: 1; mode=block
  ```
  
  This can be done in a new Middleware and configured in [`settings.py`](https://github.com/cal-itp/benefits/blob/dev/benefits/settings.py#L45) for all requests/responses.
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `benefits/settings.py`
  Content:
  ```
  1 """
  2 Django settings for benefits project.
  3 """
  4 import os
  5 
  6 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
  7 BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
  8 
  9 # SECURITY WARNING: keep the secret key used in production secret!
  10 SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
  11 
  12 # SECURITY WARNING: don't run with debug turned on in production!
  13 DEBUG = os.environ.get("DJANGO_DEBUG", "False").lower() == "true"
  14 
  15 ADMIN = os.environ.get("DJANGO_ADMIN", "False").lower() == "true"
  16 
  17 ALLOWED_HOSTS = []
  18 
  19 if DEBUG:
  20     ALLOWED_HOSTS.extend(["*"])
  21 else:
  22     hosts = os.environ["DJANGO_ALLOWED_HOSTS"].split(",")
  23     ALLOWED_HOSTS.extend(hosts)
  24 
  25 # Application definition
  26 
  27 INSTALLED_APPS = [
  28     "django.contrib.sessions",
  29     "django.contrib.staticfiles",
  30     "benefits.core",
  31     "benefits.enrollment",
  32     "benefits.eligibility",
  33 ]
  34 
  35 if ADMIN:
  36     INSTALLED_APPS.extend(
  37         [
  38             "django.contrib.admin",
  39             "django.contrib.auth",
  40             "django.contrib.contenttypes",
  41             "django.contrib.messages",
  42         ]
  43     )
  44 
  45 MIDDLEWARE = [
  46     "django.middleware.security.SecurityMiddleware",
  47     "django.contrib.sessions.middleware.SessionMiddleware",
  48     "django.middleware.locale.LocaleMiddleware",
  49     "benefits.core.middleware.Healthcheck",
  50     "django.middleware.common.CommonMiddleware",
  51     "django.middleware.csrf.CsrfViewMiddleware",
  52     "django.middleware.clickjacking.XFrameOptionsMiddleware",
  53     "benefits.core.middleware.DebugSession",
  54     "benefits.core.middleware.ChangedLanguageEvent",
  55 ]
  56 
  57 if ADMIN:
  58     MIDDLEWARE.extend(
  59         [
  60             "django.contrib.auth.middleware.AuthenticationMiddleware",
  61             "django.contrib.messages.middleware.MessageMiddleware",
  62         ]
  63     )
  64 
  65 CSRF_COOKIE_AGE = None
  66 CSRF_COOKIE_SAMESITE = "Strict"
  67 CSRF_COOKIE_HTTPONLY = True
  68 
  69 SESSION_COOKIE_SAMESITE = "Strict"
  70 SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies"
  71 SESSION_EXPIRE_AT_BROWSER_CLOSE = True
  72 
  73 if not DEBUG:
  74     CSRF_COOKIE_SECURE = True
  75     CSRF_FAILURE_VIEW = "benefits.core.views.csrf_failure"
  76     SESSION_COOKIE_SECURE = True
  77 
  78 ROOT_URLCONF = "benefits.urls"
  79 
  80 template_ctx_processors = [
  81     "django.template.context_processors.request",
  82     "benefits.core.context_processors.analytics",
  83 ]
  84 
  85 if DEBUG:
  86     template_ctx_processors.extend(
  87         [
  88             "django.template.context_processors.debug",
  89             "benefits.core.context_processors.debug",
  90         ]
  91     )
  92 
  93 if ADMIN:
  94     template_ctx_processors.extend(
  95         [
  96             "django.contrib.auth.context_processors.auth",
  97             "django.contrib.messages.context_processors.messages",
  98         ]
  99     )
  100 
  101 TEMPLATES = [
  102     {
  103         "BACKEND": "django.template.backends.django.DjangoTemplates",
  104         "DIRS": [os.path.join(BASE_DIR, "benefits", "templates")],
  105         "APP_DIRS": True,
  106         "OPTIONS": {
  107             "context_processors": template_ctx_processors,
  108         },
  109     },
  110 ]
  111 
  112 WSGI_APPLICATION = "benefits.wsgi.application"
  113 
  114 DATABASES = {
  115     "default": {
  116         "ENGINE": "django.db.backends.sqlite3",
  117         "NAME": os.environ.get("DJANGO_DB", "django") + ".db",
  118     }
  119 }
  120 
  121 # Password validation
  122 
  123 AUTH_PASSWORD_VALIDATORS = []
  124 
  125 if ADMIN:
  126     AUTH_PASSWORD_VALIDATORS.extend(
  127         [
  128             {
  129                 "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
  130             },
  131             {
  132                 "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
  133             },
  134             {
  135                 "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
  136             },
  137             {
  138                 "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
  139             },
  140         ]
  141     )
  142 
  143 # Internationalization
  144 
  145 LANGUAGE_CODE = "en"
  146 
  147 LANGUAGE_COOKIE_HTTPONLY = True
  148 LANGUAGE_COOKIE_SAMESITE = "Strict"
  149 LANGUAGE_COOKIE_SECURE = True
  150 
  151 LANGUAGES = [("en", "English"), ("es", "Español")]
  152 
  153 LOCALE_PATHS = [os.path.join(BASE_DIR, "benefits", "locale")]
  154 
  155 USE_I18N = True
  156 USE_L10N = True
  157 
  158 TIME_ZONE = "UTC"
  159 USE_TZ = True
  160 
  161 # Static files (CSS, JavaScript, Images)
  162 
  163 STATIC_URL = "/static/"
  164 STATICFILES_DIRS = [os.path.join(BASE_DIR, "benefits", "static")]
  165 STATIC_ROOT = os.path.join(BASE_DIR, "static")
  166 
  167 # Logging configuration
  168 
  169 LOG_LEVEL = os.environ.get("DJANGO_LOG_LEVEL", "DEBUG" if DEBUG else "WARNING")
  170 LOGGING = {
  171     "version": 1,
  172     "disable_existing_loggers": False,
  173     "formatters": {
  174         "default": {
  175             "format": "[{asctime}] {levelname} {name}:{lineno} {message}",
  176             "datefmt": "%d/%b/%Y %H:%M:%S",
  177             "style": "{",
  178         },
  179     },
  180     "handlers": {
  181         "default": {"class": "logging.StreamHandler", "formatter": "default"},
  182     },
  183     "root": {
  184         "handlers": ["default"],
  185         "level": LOG_LEVEL,
  186     },
  187     "loggers": {"django": {"handlers": ["default"], "propagate": False}},
  188 }
  189 
  190 # Analytics configuration
  191 
  192 ANALYTICS_KEY = os.environ.get("ANALYTICS_KEY")
  193
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/benefits/settings.py b/benefits/settings.py
  --- a/benefits/settings.py
  +++ b/benefits/settings.py
  @@ -75,6 +75,8 @@
       CSRF_FAILURE_VIEW = "benefits.core.views.csrf_failure"
       SESSION_COOKIE_SECURE = True
   
  +SECURE_BROWSER_XSS_FILTER = True
  +
   ROOT_URLCONF = "benefits.urls"
   
   template_ctx_processors = [
  
verification_info: {"golden_diff": "diff --git a/benefits/settings.py b/benefits/settings.py\n--- a/benefits/settings.py\n+++ b/benefits/settings.py\n@@ -75,6 +75,8 @@\n     CSRF_FAILURE_VIEW = \"benefits.core.views.csrf_failure\"\n     SESSION_COOKIE_SECURE = True\n \n+SECURE_BROWSER_XSS_FILTER = True\n+\n ROOT_URLCONF = \"benefits.urls\"\n \n template_ctx_processors = [\n", "issue": "Send X-XSS-Protection header\nThe X-XSS-Protection header can be used to manage certain browser's protection against reflected cross-site scripting (XSS), stopping a page from being loaded if an attack is detected. In modern browsers, the Content-Security-Policy header can provide better protection against XSS and setting X-XSS-Protection might be redundant (#203 tracks CSP implementation).\r\n\r\nSee more at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection\r\n\r\n\r\nWe'll want the following header/value:\r\n\r\n```\r\nX-XSS-Protection: 1; mode=block\r\n```\r\n\r\nThis can be done in a new Middleware and configured in [`settings.py`](https://github.com/cal-itp/benefits/blob/dev/benefits/settings.py#L45) for all requests/responses.\n", "before_files": [{"content": "\"\"\"\nDjango settings for benefits project.\n\"\"\"\nimport os\n\n# Build paths inside the project like this: os.path.join(BASE_DIR, ...)\nBASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n\n# SECURITY WARNING: keep the secret key used in production secret!\nSECRET_KEY = os.environ[\"DJANGO_SECRET_KEY\"]\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = os.environ.get(\"DJANGO_DEBUG\", \"False\").lower() == \"true\"\n\nADMIN = os.environ.get(\"DJANGO_ADMIN\", \"False\").lower() == \"true\"\n\nALLOWED_HOSTS = []\n\nif DEBUG:\n    ALLOWED_HOSTS.extend([\"*\"])\nelse:\n    hosts = os.environ[\"DJANGO_ALLOWED_HOSTS\"].split(\",\")\n    ALLOWED_HOSTS.extend(hosts)\n\n# Application definition\n\nINSTALLED_APPS = [\n    \"django.contrib.sessions\",\n    \"django.contrib.staticfiles\",\n    \"benefits.core\",\n    \"benefits.enrollment\",\n    \"benefits.eligibility\",\n]\n\nif ADMIN:\n    INSTALLED_APPS.extend(\n        [\n            \"django.contrib.admin\",\n            \"django.contrib.auth\",\n            \"django.contrib.contenttypes\",\n            \"django.contrib.messages\",\n        ]\n    )\n\nMIDDLEWARE = [\n    \"django.middleware.security.SecurityMiddleware\",\n    \"django.contrib.sessions.middleware.SessionMiddleware\",\n    \"django.middleware.locale.LocaleMiddleware\",\n    \"benefits.core.middleware.Healthcheck\",\n    \"django.middleware.common.CommonMiddleware\",\n    \"django.middleware.csrf.CsrfViewMiddleware\",\n    \"django.middleware.clickjacking.XFrameOptionsMiddleware\",\n    \"benefits.core.middleware.DebugSession\",\n    \"benefits.core.middleware.ChangedLanguageEvent\",\n]\n\nif ADMIN:\n    MIDDLEWARE.extend(\n        [\n            \"django.contrib.auth.middleware.AuthenticationMiddleware\",\n            \"django.contrib.messages.middleware.MessageMiddleware\",\n        ]\n    )\n\nCSRF_COOKIE_AGE = None\nCSRF_COOKIE_SAMESITE = \"Strict\"\nCSRF_COOKIE_HTTPONLY = True\n\nSESSION_COOKIE_SAMESITE = \"Strict\"\nSESSION_ENGINE = \"django.contrib.sessions.backends.signed_cookies\"\nSESSION_EXPIRE_AT_BROWSER_CLOSE = True\n\nif not DEBUG:\n    CSRF_COOKIE_SECURE = True\n    CSRF_FAILURE_VIEW = \"benefits.core.views.csrf_failure\"\n    SESSION_COOKIE_SECURE = True\n\nROOT_URLCONF = \"benefits.urls\"\n\ntemplate_ctx_processors = [\n    \"django.template.context_processors.request\",\n    \"benefits.core.context_processors.analytics\",\n]\n\nif DEBUG:\n    template_ctx_processors.extend(\n        [\n            \"django.template.context_processors.debug\",\n            \"benefits.core.context_processors.debug\",\n        ]\n    )\n\nif ADMIN:\n    template_ctx_processors.extend(\n        [\n            \"django.contrib.auth.context_processors.auth\",\n            \"django.contrib.messages.context_processors.messages\",\n        ]\n    )\n\nTEMPLATES = [\n    {\n        \"BACKEND\": \"django.template.backends.django.DjangoTemplates\",\n        \"DIRS\": [os.path.join(BASE_DIR, \"benefits\", \"templates\")],\n        \"APP_DIRS\": True,\n        \"OPTIONS\": {\n            \"context_processors\": template_ctx_processors,\n        },\n    },\n]\n\nWSGI_APPLICATION = \"benefits.wsgi.application\"\n\nDATABASES = {\n    \"default\": {\n        \"ENGINE\": \"django.db.backends.sqlite3\",\n        \"NAME\": os.environ.get(\"DJANGO_DB\", \"django\") + \".db\",\n    }\n}\n\n# Password validation\n\nAUTH_PASSWORD_VALIDATORS = []\n\nif ADMIN:\n    AUTH_PASSWORD_VALIDATORS.extend(\n        [\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.UserAttributeSimilarityValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.MinimumLengthValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.CommonPasswordValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.NumericPasswordValidator\",\n            },\n        ]\n    )\n\n# Internationalization\n\nLANGUAGE_CODE = \"en\"\n\nLANGUAGE_COOKIE_HTTPONLY = True\nLANGUAGE_COOKIE_SAMESITE = \"Strict\"\nLANGUAGE_COOKIE_SECURE = True\n\nLANGUAGES = [(\"en\", \"English\"), (\"es\", \"Espa\u00f1ol\")]\n\nLOCALE_PATHS = [os.path.join(BASE_DIR, \"benefits\", \"locale\")]\n\nUSE_I18N = True\nUSE_L10N = True\n\nTIME_ZONE = \"UTC\"\nUSE_TZ = True\n\n# Static files (CSS, JavaScript, Images)\n\nSTATIC_URL = \"/static/\"\nSTATICFILES_DIRS = [os.path.join(BASE_DIR, \"benefits\", \"static\")]\nSTATIC_ROOT = os.path.join(BASE_DIR, \"static\")\n\n# Logging configuration\n\nLOG_LEVEL = os.environ.get(\"DJANGO_LOG_LEVEL\", \"DEBUG\" if DEBUG else \"WARNING\")\nLOGGING = {\n    \"version\": 1,\n    \"disable_existing_loggers\": False,\n    \"formatters\": {\n        \"default\": {\n            \"format\": \"[{asctime}] {levelname} {name}:{lineno} {message}\",\n            \"datefmt\": \"%d/%b/%Y %H:%M:%S\",\n            \"style\": \"{\",\n        },\n    },\n    \"handlers\": {\n        \"default\": {\"class\": \"logging.StreamHandler\", \"formatter\": \"default\"},\n    },\n    \"root\": {\n        \"handlers\": [\"default\"],\n        \"level\": LOG_LEVEL,\n    },\n    \"loggers\": {\"django\": {\"handlers\": [\"default\"], \"propagate\": False}},\n}\n\n# Analytics configuration\n\nANALYTICS_KEY = os.environ.get(\"ANALYTICS_KEY\")\n", "path": "benefits/settings.py"}], "after_files": [{"content": "\"\"\"\nDjango settings for benefits project.\n\"\"\"\nimport os\n\n# Build paths inside the project like this: os.path.join(BASE_DIR, ...)\nBASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n\n# SECURITY WARNING: keep the secret key used in production secret!\nSECRET_KEY = os.environ[\"DJANGO_SECRET_KEY\"]\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = os.environ.get(\"DJANGO_DEBUG\", \"False\").lower() == \"true\"\n\nADMIN = os.environ.get(\"DJANGO_ADMIN\", \"False\").lower() == \"true\"\n\nALLOWED_HOSTS = []\n\nif DEBUG:\n    ALLOWED_HOSTS.extend([\"*\"])\nelse:\n    hosts = os.environ[\"DJANGO_ALLOWED_HOSTS\"].split(\",\")\n    ALLOWED_HOSTS.extend(hosts)\n\n# Application definition\n\nINSTALLED_APPS = [\n    \"django.contrib.sessions\",\n    \"django.contrib.staticfiles\",\n    \"benefits.core\",\n    \"benefits.enrollment\",\n    \"benefits.eligibility\",\n]\n\nif ADMIN:\n    INSTALLED_APPS.extend(\n        [\n            \"django.contrib.admin\",\n            \"django.contrib.auth\",\n            \"django.contrib.contenttypes\",\n            \"django.contrib.messages\",\n        ]\n    )\n\nMIDDLEWARE = [\n    \"django.middleware.security.SecurityMiddleware\",\n    \"django.contrib.sessions.middleware.SessionMiddleware\",\n    \"django.middleware.locale.LocaleMiddleware\",\n    \"benefits.core.middleware.Healthcheck\",\n    \"django.middleware.common.CommonMiddleware\",\n    \"django.middleware.csrf.CsrfViewMiddleware\",\n    \"django.middleware.clickjacking.XFrameOptionsMiddleware\",\n    \"benefits.core.middleware.DebugSession\",\n    \"benefits.core.middleware.ChangedLanguageEvent\",\n]\n\nif ADMIN:\n    MIDDLEWARE.extend(\n        [\n            \"django.contrib.auth.middleware.AuthenticationMiddleware\",\n            \"django.contrib.messages.middleware.MessageMiddleware\",\n        ]\n    )\n\nCSRF_COOKIE_AGE = None\nCSRF_COOKIE_SAMESITE = \"Strict\"\nCSRF_COOKIE_HTTPONLY = True\n\nSESSION_COOKIE_SAMESITE = \"Strict\"\nSESSION_ENGINE = \"django.contrib.sessions.backends.signed_cookies\"\nSESSION_EXPIRE_AT_BROWSER_CLOSE = True\n\nif not DEBUG:\n    CSRF_COOKIE_SECURE = True\n    CSRF_FAILURE_VIEW = \"benefits.core.views.csrf_failure\"\n    SESSION_COOKIE_SECURE = True\n\nSECURE_BROWSER_XSS_FILTER = True\n\nROOT_URLCONF = \"benefits.urls\"\n\ntemplate_ctx_processors = [\n    \"django.template.context_processors.request\",\n    \"benefits.core.context_processors.analytics\",\n]\n\nif DEBUG:\n    template_ctx_processors.extend(\n        [\n            \"django.template.context_processors.debug\",\n            \"benefits.core.context_processors.debug\",\n        ]\n    )\n\nif ADMIN:\n    template_ctx_processors.extend(\n        [\n            \"django.contrib.auth.context_processors.auth\",\n            \"django.contrib.messages.context_processors.messages\",\n        ]\n    )\n\nTEMPLATES = [\n    {\n        \"BACKEND\": \"django.template.backends.django.DjangoTemplates\",\n        \"DIRS\": [os.path.join(BASE_DIR, \"benefits\", \"templates\")],\n        \"APP_DIRS\": True,\n        \"OPTIONS\": {\n            \"context_processors\": template_ctx_processors,\n        },\n    },\n]\n\nWSGI_APPLICATION = \"benefits.wsgi.application\"\n\nDATABASES = {\n    \"default\": {\n        \"ENGINE\": \"django.db.backends.sqlite3\",\n        \"NAME\": os.environ.get(\"DJANGO_DB\", \"django\") + \".db\",\n    }\n}\n\n# Password validation\n\nAUTH_PASSWORD_VALIDATORS = []\n\nif ADMIN:\n    AUTH_PASSWORD_VALIDATORS.extend(\n        [\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.UserAttributeSimilarityValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.MinimumLengthValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.CommonPasswordValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.NumericPasswordValidator\",\n            },\n        ]\n    )\n\n# Internationalization\n\nLANGUAGE_CODE = \"en\"\n\nLANGUAGE_COOKIE_HTTPONLY = True\nLANGUAGE_COOKIE_SAMESITE = \"Strict\"\nLANGUAGE_COOKIE_SECURE = True\n\nLANGUAGES = [(\"en\", \"English\"), (\"es\", \"Espa\u00f1ol\")]\n\nLOCALE_PATHS = [os.path.join(BASE_DIR, \"benefits\", \"locale\")]\n\nUSE_I18N = True\nUSE_L10N = True\n\nTIME_ZONE = \"UTC\"\nUSE_TZ = True\n\n# Static files (CSS, JavaScript, Images)\n\nSTATIC_URL = \"/static/\"\nSTATICFILES_DIRS = [os.path.join(BASE_DIR, \"benefits\", \"static\")]\nSTATIC_ROOT = os.path.join(BASE_DIR, \"static\")\n\n# Logging configuration\n\nLOG_LEVEL = os.environ.get(\"DJANGO_LOG_LEVEL\", \"DEBUG\" if DEBUG else \"WARNING\")\nLOGGING = {\n    \"version\": 1,\n    \"disable_existing_loggers\": False,\n    \"formatters\": {\n        \"default\": {\n            \"format\": \"[{asctime}] {levelname} {name}:{lineno} {message}\",\n            \"datefmt\": \"%d/%b/%Y %H:%M:%S\",\n            \"style\": \"{\",\n        },\n    },\n    \"handlers\": {\n        \"default\": {\"class\": \"logging.StreamHandler\", \"formatter\": \"default\"},\n    },\n    \"root\": {\n        \"handlers\": [\"default\"],\n        \"level\": LOG_LEVEL,\n    },\n    \"loggers\": {\"django\": {\"handlers\": [\"default\"], \"propagate\": False}},\n}\n\n# Analytics configuration\n\nANALYTICS_KEY = os.environ.get(\"ANALYTICS_KEY\")\n", "path": "benefits/settings.py"}]}