I have two questions:

  1. How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys my reflected XSS tests. I know Chrome has a directive --disable-xss-auditor to ignore it but I can't find anywhere how to do the same in Firefox.

  2. How to disable XSS protection from web browser itself (Firefox + Chrome). I'm now not saying about header from a server, but how to disable built into web browser protection against reflected XSS?

  • 2
    AFAIK firefox doesn't have an xss filter like Chrome and IE do and ignores that header. bugzilla.mozilla.org/show_bug.cgi?id=528661 . – Neil McGuigan Dec 15 '15 at 22:48
  • You might want to have a look at proxomtron – symcbean Dec 15 '15 at 22:55
  • @NeilMcGuigan that would explain why I couldn't find answer to 'how to disable it'. I've seen that bug ticket and a few other related to this but some time left since last update so thought it was introduced. Do you know the answer for 2) ? – inferno Dec 15 '15 at 23:04
  • @symcbean Thanks Colin, but I'm looking for something in browser itself. – inferno Dec 15 '15 at 23:08
  • Assuming you're using Burp Suite (like everybody does), you should use a response rewrite rule to convert that header to a 0 (and possibly add it if not present). Works with all browsers and doesn't require using a different browser configuration when you want to test something (aside from running traffic through the proxy). – CBHacking Nov 25 '17 at 8:23

For Firefox,

  1. Go to the url bar, type about:config and press enter.
  2. Type browser.urlbar.filter.javascript in the Search bar and you will see the following: screenshot_firefox_xss_boolean

  3. Double click on the True value to turn it to False.

  4. Done!

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.