4

I am using the following command to launch Chrome:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security 

to turn off XSS auditor in chrome in Windows 7, but failed to do so. Below is the screenshot, and any help is appreciated!

browser screenshot including console error

3

1 Answer 1

2

I am fairly sure your answer lies in the error message.

The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.

I guess Google wants you to be super-duper sure that you want to allow XSS. Try running a local server that returns either of these headers:

  • X-XSS-Protection
  • Content-Security-Policy

This can be pretty annoying if you are trying to do a simple demonstration using a locally created file, but it is in our best interest, I guess. It may be that Firefox/IE are worth a shot if you just want to see/show how XSS works, but don't want to set up an http server.

EDIT: also make sure you close all instances of chrome when you run a command line.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.