Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have enabled XSS protection in server using nginx with below header. But After long research google chrome, IE 10 & above and safari supports that but Firefox doesnt support
add_header X-XSS-Protection: "1; mode=block";
For eg: when i try below url in IE, chrome and safari it blocks
https://xyz.com/test"><img src%3Dx onerror%3Dalert("xss")></
But Firefox executes alert. Please help me to fix for Mozilla FF.
Firefox doesn't support the X-XSS-Protection header as you can see in this compatibility table.
If you want similar protection against reflected XSS as a Firefox user, you can use the NoScript addon. It has an anti-XSS feature that can similarly warn you if it identifies script code in the URL.
You should only see the header as a last line of defense that doesn't replace proper output escaping and the usual anti-XSS measures. Many websites like Facebook don't enable the header at all because it can occasionally cause security problems itself.
On the server side you can also deploy a web application firewall that may attempt to block XSS attempts. But your first security measure should be a secure application that properly filters output itself.
