diff --git a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/factory/SecureHeadersWebFilterFactory.java b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/factory/SecureHeadersWebFilterFactory.java
index 1b2dcaeb..bd65d99b 100644
--- a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/factory/SecureHeadersWebFilterFactory.java
+++ b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/factory/SecureHeadersWebFilterFactory.java
@@ -49,6 +49,7 @@ public class SecureHeadersWebFilterFactory implements WebFilterFactory {
 		return (exchange, chain) -> {
 			HttpHeaders headers = exchange.getResponse().getHeaders();
 
+			//TODO: allow header to be disabled
 			headers.add(X_XSS_PROTECTION_HEADER, properties.getXssProtectionHeader());
 			headers.add(STRICT_TRANSPORT_SECURITY_HEADER, properties.getStrictTransportSecurity());
 			headers.add(X_FRAME_OPTIONS_HEADER, properties.getFrameOptions());