48

I'm getting this chrome flag when trying to post and then get a simple form.

The problem is that the Developer Console shows nothing about this and I cannot find the source of the problem by myself.

Is there any option for looking this at more detail? View the piece of code triggering the error for fixing it...

3
  • Looks like this is a known issue with Chrome 57. groups.google.com/a/chromium.org/forum/#!topic/chromium-discuss/… Sounds like 58 fixes this.
    – Eric Moran
    Apr 6, 2017 at 13:23
  • 2
    Yeah this sucks! I'm getting this error on a development site on my localhost for a Yii PHP app which I believe is trying to show the error page and stack trace!
    – Chloe
    May 9, 2017 at 18:47
  • 2
    Chrome 60.0.3112.101 still does this. Looks like it's here to stay. Be nice it it automatically bypassed for local domains ...
    – frumbert
    Aug 20, 2017 at 23:54

8 Answers 8

73

The simple way for bypass this error in developing is send header to browser

Put the header before send data to browser.

In php you can send this header for bypass this error ,send header reference:

header('X-XSS-Protection:0');

In the ASP.net you can send this header and send header reference:

HttpContext.Response.AddHeader("X-XSS-Protection","0");
or 
HttpContext.Current.Response.AddHeader("X-XSS-Protection","0"); 

In the nodejs send header, send header reference :

res.writeHead(200, {'X-XSS-Protection':0 });
// or express js
res.set('X-XSS-Protection', 0);
6
  • 1
    This worked for me. In my scenario I was just trying to var_dump($_POST). Put the header before the var_dump and it worked.
    – Rob
    Jun 22, 2017 at 16:42
  • @Rob Yes I have your problem too, And fix by header. Thanks Updated the answer.
    – A1Gard
    Jun 22, 2017 at 22:08
  • 1
    It works perfectly. For Classic ASP you can use: Response.AddHeader "X-XSS-Protection", 0
    – Niente0
    Nov 20, 2017 at 14:34
  • HttpContext.Response.AddHeader has a string name, string value signature, but that definitely fixed our issue with a in-page script editor. Thanks!
    – Ripside
    Dec 5, 2017 at 19:02
  • For ASP.NET should be with 'Current'; HttpContext.Current.Response.AddHeader("X-XSS-Protection","0"); Thanks for your solution.
    – Erdogan
    May 9, 2018 at 14:23
26

Chrome v58 might or might not fix your issue... It really depends to what you're actually POSTing. For example, if you're trying to POST some raw HTML/XML data whithin an input/select/textarea element, your request might still be blocked from the auditor.

In the past few days I hit this issue in two different scenarios: a WYSIWYG client-side editor and an interactive upload form featuring some kind of content preview. I managed to fix them both by base64-encoding the raw HTML before POSTing it, then decoding it on the receiving PHP page. This will most likely fix the issue and, most importantly, increase the developer's awareness level regarding the data coming from POST requests, hopefully pushing him into adopting effective data encoding/decoding strategies and strengthen their web application from XSS-type attacks.

To base64-encode your content on the client side you can either use the native btoa() function, which is supported by most browsers nowadays, or a third-party alternative such as a jQuery plugin (I ended up using this, which worked ok).

To base64-decode the POST data you can then use PHP's base64_decode(str) function, ASP.NET's Convert.FromBase64String(str) or anything else (depending on your server-side scenario).

For further info, check out this blog post that I wrote on the topic.

4
  • 5
    Base64 encoding will NOT improve safety against xss attacks. How do you think it would possibly do that? It only makes your request opaque to the chrome xxs auditor. The content still contains possible xss attacks and will be decoded and possibly placed in user facing browser contexts by your site
    – Jamie Pate
    Jun 26, 2017 at 15:42
  • @JamiePate I meant to say that base64 forces the developer to decode the input data, increasing his awareness level for the whole input-output process, hopefully leading him to escape the content before using it. I did an edit to better clarify the concept.
    – Darkseal
    Jun 27, 2017 at 14:23
  • Still a tenuous leap, since most developers will use $('form').serialize() or similar anyways. This approach does not provide any xss benefits imo, but is a valid workaround. (Adding the header is better though)
    – Jamie Pate
    Jun 28, 2017 at 14:38
  • 1
    Bullseye! My POST data contains "<input" HTML-encoded. Switching it do Base-64 encoding succesfully hid it from Chrome. Jun 29, 2017 at 21:55
5

In this case, being a first-time contributor at the Creative forums, (some kind of vBulletin construct) and reduced to posting a PM to the moderators before forum access it is easy for one to encapsulate the nature of the issue from the more popular answers above. The command was

http://forums.creative.com/private.php?do=insertpm&pmid=

And as described above the actual data was "raw HTML/XML data within an input/select/textarea element".

The general requirement for handling such a bug (or feature) at the user end is some kind of quick fixit tweak or twiddle. This post discusses the option of clearing cache, resetting Chrome settings, creating a new_user or retrying the operation with a new beta release. It was also suggested that one launches a new instance with the following:

google-chrome-stable --disable-xss-auditor

The launch actually worked in this W10 1703 Chrome 061 edition after this modified version:

chrome --disable-xss-auditor

However, on logging back in to the site and attempting the post again, the same error was generated. Perhaps the syntax wants refining or something else is awry.

It then seemed reasonable to launched Edge and repost from there, which turned out to be no problem at all.

1
  • for me on mac: /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --disable-xss-auditor
    – devaaron
    Dec 14, 2017 at 17:35
3

This may help in some circumstances. Modify Apache httpd.conf file and add

ResponseHeader set X-XSS-Protection 0

It may have been fixed in Version 58.0.3029.110 (64-bit).

2
  • Was present in 58.0.3029.110, but its fixed in 59.0.3071.86
    – dhaupin
    Jun 13, 2017 at 14:11
  • 4
    There is no apache ResponseHeader directive -- there is a RequestHeader and a Header directive in mod_headers. Trying ResponseHeader causes a 500 server error for me and the error logged: Invalid command 'ResponseHeader', perhaps misspelled or defined by a module not included in the server configuration. Instead I tried: Header set X-XSS-Protection 0 in the .htaccess file and that fixed the nasty XSS_AUDITOR error in Chrome 58 for me!
    – gigawatt
    Jun 19, 2017 at 19:45
2

I've noticed that if there is an apostrophe ' in the text Chrome will block it.

0

When I update href from javascript:void(0) to # in the page of POST request, it works.

For example:

<a href="javascript:void(0)" id="loginlink">login</a>

Change to:

<a href="#" id="loginlink">login</a>
0
0

I solved the problem!

In my case when I make the submmit, I send the HTML to the action and in the model I had a property that accept the HTML with "AllowHTML".

The solution consist in remove this "AllowHTML" property and everything go OK!

Obviously I no longer send the HTML to the action because in my case I do not need it

0

It is a Chrome bug. The only remedy is to use FireFox until they fix this Chrome bug. XSS auditor trashing a page, that has worked fine for 20 years, seems to be a symptom, not a cause.

3
  • 1
    20 years? hard for me to imagine a web page that has not changed in 20 years. because it has worked for 20 years does NOT mean that it is not susceptible to a cross-site scripting attack.
    – pRose_la
    Sep 18, 2017 at 14:51
  • 1
    if anything, that site sounds like it's more vulnerable to XSS being as dated as it is.
    – brandito
    Oct 26, 2017 at 0:18
  • 1
    "The only remedy is to use FireFox until they fix this Chrome bug" - And how would you impose this solution on your users without alienating them all? Dec 7, 2018 at 11:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.