How to enable the `report` directive with X–XSS–Protection

Previous versions of Helmet and x-xss-protection allowed you to add the report directive. This functionality was removed because enabling this header is no longer recommended.

If you still need to set a report directive for some reason, you can write your own small middleware:

// NOTE: This is discouraged.
app.use((req, res, next) => {
  res.setHeader("X-XSS-Protection", "1; mode=block; report=/report-path");
  next();
});