How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys my reflected XSS tests.
I know Chrome has a directive --disable-xss-auditor to ignore it but I can't find anywhere how to do the same in Firefox.
How to disable XSS protection from web browser itself (Firefox + Chrome). I'm now not saying about header from a server, but how to disable built into web browser protection against reflected XSS?
This question is old and was answered in the comments, maybe it is time to close it. The answers to your questions should be:
Quoting Neil McGuigan, "Firefox doesn't have an XSS filter like Chrome and IE do, therefore it already ignores that header" (link). In the meantime also Chromium removed their XSS Auditor (link).
Being there no such thing as XSS protection, you probably refer to automatic URL encoding, which is mandatory and cannot be disabled:
"All unsafe characters must always be encoded within a URL" (RFC
"The URI producer will transform the local encoding to one that is
suitable for a public interface and then transform the public
interface encoding into the restricted set of URI characters
(reserved, unreserved, and percent-encodings)" (RFC 3986)
0(and possibly add it if not present). Works with all browsers and doesn't require using a different browser configuration when you want to test something (aside from running traffic through the proxy).