Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am using the following command to launch Chrome:
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security
to turn off XSS auditor in chrome in Windows 7, but failed to do so. Below is the screenshot, and any help is appreciated!
I am fairly sure your answer lies in the error message.
The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.
I guess Google wants you to be super-duper sure that you want to allow XSS. Try running a local server that returns either of these headers:
This can be pretty annoying if you are trying to do a simple demonstration using a locally created file, but it is in our best interest, I guess. It may be that Firefox/IE are worth a shot if you just want to see/show how XSS works, but don't want to set up an http server.
EDIT: also make sure you close all instances of chrome when you run a command line.
--disable-xss-auditorinstead.