I have enabled XSS protection in server using nginx with below header. But After long research google chrome, IE 10 & above and safari supports that but Firefox doesnt support

add_header X-XSS-Protection: "1; mode=block";

For eg: when i try below url in IE, chrome and safari it blocks

https://xyz.com/test"><img src%3Dx onerror%3Dalert("xss")></

But Firefox executes alert. Please help me to fix for Mozilla FF.

1 Answer 1


Firefox doesn't support the X-XSS-Protection header as you can see in this compatibility table.

If you want similar protection against reflected XSS as a Firefox user, you can use the NoScript addon. It has an anti-XSS feature that can similarly warn you if it identifies script code in the URL.

You should only see the header as a last line of defense that doesn't replace proper output escaping and the usual anti-XSS measures. Many websites like Facebook don't enable the header at all because it can occasionally cause security problems itself.

On the server side you can also deploy a web application firewall that may attempt to block XSS attempts. But your first security measure should be a secure application that properly filters output itself.

  • Thanks for the help. But how can do through server or on my coding (PHP). No script addon is plugin for firefox browser i can't inform all user to enable addon before using my site.
    – satheesh
    Feb 24, 2017 at 19:19
  • @satheesh I amended my answer. What is it exactly that you need? The correct way to tackle reflected XSS is filtering output. You may not want to rely on additional headers too much.
    – Arminius
    Feb 24, 2017 at 19:30
  • I'm using Drupal7 above issue given by security team on vulnerability. Its blocked in all browser except Firefox. can you help on any other way to fix security hole for Firefox.
    – satheesh
    Feb 24, 2017 at 19:49
  • @satheesh You need to find out what the exact vulnerability is and see if there is a patch available - or patch it yourself. Without details of the bug, it will be hard to help you fix it.
    – Arminius
    Feb 24, 2017 at 19:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.