I have two questions:

  1. How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys my reflected XSS tests. I know Chrome has a directive --disable-xss-auditor to ignore it but I can't find anywhere how to do the same in Firefox.

  2. How to disable XSS protection from web browser itself (Firefox + Chrome). I'm now not saying about header from a server, but how to disable built into web browser protection against reflected XSS?

  • 3
    AFAIK firefox doesn't have an xss filter like Chrome and IE do and ignores that header. bugzilla.mozilla.org/show_bug.cgi?id=528661 . Dec 15, 2015 at 22:48
  • @NeilMcGuigan that would explain why I couldn't find answer to 'how to disable it'. I've seen that bug ticket and a few other related to this but some time left since last update so thought it was introduced. Do you know the answer for 2) ?
    – inferno
    Dec 15, 2015 at 23:04
  • 1
    Assuming you're using Burp Suite (like everybody does), you should use a response rewrite rule to convert that header to a 0 (and possibly add it if not present). Works with all browsers and doesn't require using a different browser configuration when you want to test something (aside from running traffic through the proxy).
    – CBHacking
    Nov 25, 2017 at 8:23
  • 1. If you are allowed to use Addon you can use addons.mozilla.org/en-US/firefox/addon/modify-header-value 2. For Firefox you can try Open Firefox -> type "about:config" in the address bar -> Search "browser.urlbar.filter.javascript" -> Select "False" Feb 16 at 12:00


You must log in to answer this question.

Browse other questions tagged .