9

I have two questions:

  1. How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys my reflected XSS tests. I know Chrome has a directive --disable-xss-auditor to ignore it but I can't find anywhere how to do the same in Firefox.

  2. How to disable XSS protection from web browser itself (Firefox + Chrome). I'm now not saying about header from a server, but how to disable built into web browser protection against reflected XSS?

  • 2
    AFAIK firefox doesn't have an xss filter like Chrome and IE do and ignores that header. bugzilla.mozilla.org/show_bug.cgi?id=528661 . – Neil McGuigan Dec 15 '15 at 22:48
  • You might want to have a look at proxomtron – symcbean Dec 15 '15 at 22:55
  • @NeilMcGuigan that would explain why I couldn't find answer to 'how to disable it'. I've seen that bug ticket and a few other related to this but some time left since last update so thought it was introduced. Do you know the answer for 2) ? – inferno Dec 15 '15 at 23:04
  • @symcbean Thanks Colin, but I'm looking for something in browser itself. – inferno Dec 15 '15 at 23:08
  • 1
    Assuming you're using Burp Suite (like everybody does), you should use a response rewrite rule to convert that header to a 0 (and possibly add it if not present). Works with all browsers and doesn't require using a different browser configuration when you want to test something (aside from running traffic through the proxy). – CBHacking Nov 25 '17 at 8:23
1

This question is old and was answered in the comments, maybe it is time to close it. The answers to your questions should be:

  1. Quoting Neil McGuigan, "Firefox doesn't have an XSS filter like Chrome and IE do, therefore it already ignores that header" (link). In the meantime also Chromium removed their XSS Auditor (link).

  2. Being there no such thing as XSS protection, you probably refer to automatic URL encoding, which is mandatory and cannot be disabled:

"All unsafe characters must always be encoded within a URL" (RFC 1738)

"The URI producer will transform the local encoding to one that is suitable for a public interface and then transform the public interface encoding into the restricted set of URI characters (reserved, unreserved, and percent-encodings)" (RFC 3986)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.