Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome.


share|improve this question

closed as off-topic by NULLZ, Xander, Adi, TildalWave, Iszi Oct 3 '13 at 18:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

no-script for firefox, none of these filers work very well. – rook Oct 1 '13 at 16:30

1 Answer 1

Chrome ( and most likely Firefox ) already prevent execution of scripts when they are given in for example the URL parameter, maybe even other things like a request body, and then proceed to give you a warning.

See also Does Google Chrome protect against cross site scripting (XSS)?

Also when you search for XSS prevention in the chrome extension store, you will get results.

share|improve this answer
I tried a reflected XSS on It works in chrome as well as firefox. here search box in vulnerable to xss – Naman Oct 1 '13 at 14:49
That website sends an http header of "X-XSS-Protection:0", you can guess what that does. You cannot use that website to test a browser's XSS Protection. See also this question – Philipp Oct 1 '13 at 15:11
Nice. But now I am making a simple page and running it on apache local server, still reflected xss happening – Naman Oct 1 '13 at 17:01
What would you say about – Naman Oct 1 '13 at 17:04
That is a page where javascript reads the input field and just appends the text as html, the xss data does not come from a request... – Philipp Oct 2 '13 at 7:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.