11

I have two questions:

  1. How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys my reflected XSS tests. I know Chrome has a directive --disable-xss-auditor to ignore it but I can't find anywhere how to do the same in Firefox.

  2. How to disable XSS protection from web browser itself (Firefox + Chrome). I'm now not saying about header from a server, but how to disable built into web browser protection against reflected XSS?

Improve this question
6
  • 3
    AFAIK firefox doesn't have an xss filter like Chrome and IE do and ignores that header. bugzilla.mozilla.org/show_bug.cgi?id=528661 .
    – Neil McGuigan
    Dec 15, 2015 at 22:48
  • You might want to have a look at proxomtron
    – symcbean
    Dec 15, 2015 at 22:55
  • @NeilMcGuigan that would explain why I couldn't find answer to 'how to disable it'. I've seen that bug ticket and a few other related to this but some time left since last update so thought it was introduced. Do you know the answer for 2) ?
    – inferno
    Dec 15, 2015 at 23:04
  • @symcbean Thanks Colin, but I'm looking for something in browser itself.
    – inferno
    Dec 15, 2015 at 23:08
  • 1
    Assuming you're using Burp Suite (like everybody does), you should use a response rewrite rule to convert that header to a 0 (and possibly add it if not present). Works with all browsers and doesn't require using a different browser configuration when you want to test something (aside from running traffic through the proxy).
    – CBHacking
    Nov 25, 2017 at 8:23

1 Answer 1

Reset to default
1

This question is old and was answered in the comments, maybe it is time to close it. The answers to your questions should be:

  1. Quoting Neil McGuigan, "Firefox doesn't have an XSS filter like Chrome and IE do, therefore it already ignores that header" (link). In the meantime also Chromium removed their XSS Auditor (link).

  2. Being there no such thing as XSS protection, you probably refer to automatic URL encoding, which is mandatory and cannot be disabled:

"All unsafe characters must always be encoded within a URL" (RFC 1738)

"The URI producer will transform the local encoding to one that is suitable for a public interface and then transform the public interface encoding into the restricted set of URI characters (reserved, unreserved, and percent-encodings)" (RFC 3986)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .