Can't use form-data if nuxt-security on.

[kiranimeid]

hello, today i notice i can't use any form-data for uploading image when nuxt-security is on. here's the response:

{"url":"/api/upload/image-editor","statusCode":400,"statusMessage":"Bad Request","message":"Bad Request","stack":"<pre><span class=\"stack internal\">at createError (//node_modules/h3/dist/index.mjs:78:15)</span>\n<span class=\"stack internal\">at Object.handler (\\node_modules\\nuxt-security\\dist\\runtime\\server\\middleware\\xssValidator.mjs:26:19)</span>\n<span class=\"stack internal\">at process.processTicksAndRejections (node:internal/process/task_queues:95:5)</span>\n<span class=\"stack internal\">at async Object.handler (//node_modules/h3/dist/index.mjs:1676:19)</span>\n<span class=\"stack internal\">at async Server.toNodeHandle (//node_modules/h3/dist/index.mjs:1886:7)</span></pre>"}

it's working fine when the module is not included. I don't know how to fix it, i am trying the default config, turning off xss, but no luck.

[kiranimeid]

my bad, re-read the doc about xss and i missed the per-route rule.

[v0id-4lpz]

Hi @kiranimeid
I have the same problem but the per route rule dont work for me.
Can you explain more your move?

routeRules: {
	'/api/upload': {
		security: {
			headers: {
				xXSSProtection: false,
			},
		},
	},
},

but 400 Bad Request

<pre><span class="stack internal">at createError (/D:/Projects/aaa/node_modules/h3/dist/index.mjs:79:15)</span>
<span class="stack internal">at Object.handler (D:\Projects\aaa\node_modules\nuxt-security\dist\runtime\server\middleware\xssValidator.mjs:26:19)</span>
<span class="stack internal">at process.processTicksAndRejections (node:internal/process/task_queues:95:5)</span>
<span class="stack internal">at async Object.handler (/D:/Projects/aaa/node_modules/h3/dist/index.mjs:1697:19)</span>
<span class="stack internal">at async Server.toNodeHandle (/D:/Projects/aaa/node_modules/h3/dist/index.mjs:1907:7)</span></pre>

[v0id-4lpz]

my bad, i had to define xssValidator instead of xXSSProtection

routeRules: {
	'/api/upload': {
		security: {
			xssValidator: false,
		},
	},
},

No clear docs/resources about upload