title: What is the http-header "X-XSS-Protection"?
body: <p>So I've been toying around with HTTP for fun in telnet now (i.e. just typing in <code>telnet google.com 80</code> and putting in random GETs and POSTs with different headers and the like) but I've come across something that google.com transmits in it's headers that I don't know.</p>
  
  <p>I've been looking through <a href="http://www.w3.org/Protocols/rfc2616/rfc2616.html" rel="noreferrer">http://www.w3.org/Protocols/rfc2616/rfc2616.html</a> and have found no definition for this particular http-header that google seems to be spouting out:</p>
  
  <pre><code>GET / HTTP/1.1
  
  HTTP/1.1 200 OK
  Date: Wed, 01 Feb 2012 03:42:24 GMT
  Expires: -1
  Cache-Control: private, max-age=0
  Content-Type: text/html; charset=ISO-8859-1
  Set-Cookie: PREF=ID=6ddbc0a0342e7e63:FF=0:TM=1328067744:LM=1328067744:S=4d4farvCGl5Ww0C3; expires=Fri, 31-Jan-2014 03:42:24 GMT; path=/; domain=.google.com
  Set-Cookie: NID=56=PgRwCKa8EltKnHS5clbFuhwyWsd3cPXiV1-iXzgyKsiy5RKXEKbg89gWWpjzYZjLPWTKrCWhOUhdInOlYU56LOb2W7XpC7uBnKAjMbxQSBw1UIprzw2BFK5dnaY7PRji; expires=Thu, 02-Aug-2012 03:42:24 GMT; path=/; domain=.google.com; HttpOnly
  P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&amp;answer=151657 for more info."
  Server: gws
  X-XSS-Protection: 1; mode=block
  X-Frame-Options: SAMEORIGIN
  Transfer-Encoding: chunked
  
  1000
  </code></pre>
  
  <p>Anyone know what <code>X-XSS-Protection</code> is?</p>