Disable cross domain web security in Firefox

security firefox cross-domain cors
Oscar Godson picture Oscar Godson · Jul 18, 2013 · Viewed 197k times · Source

In Firefox, how do I do the equivalent of --disable-web-security in Chrome. This has been posted a lot, but never a true answer. Most are links to add-ons (some of which don't work in the latest Firefox or don't work at all) and "you just need to enable support on the server".

  1. This is temporary to test. I know the security implications.
  2. I can't turn on CORS on the server and I especially would never be able to allow localhost or similar.
  3. A flag, or setting, or something would be a lot better than a plugin. I also tried: http://www-jo.se/f.pfleger/forcecors, but something must be wrong since my requests come back as completely empty, but same requests in Chrome come back fine.

Again, this is only for testing before pushing to prod which, then, would be on an allowable domain.

Answer

Peter picture Peter · Oct 8, 2014

Almost everywhere you look, people refer to the about:config and the security.fileuri.strict_origin_policy. Sometimes also the network.http.refere.XOriginPolicy.

For me, none of these seem to have any effect.

This comment implies there is no built-in way in Firefox to do this (as of 2/8/14).

Related questions

Why am I suddenly getting a "Blocked loading mixed active content" issue in Firefox?

This morning, upon upgrading my Firefox browser to the latest version (from 22 to 23), some of the key aspects of my back office (website) stopped working. Looking at the Firebug log, the following errors were being reported: Blocked loading mixed active …

Read More
Disable firefox same origin policy

I'm developing a local research tool that requires me to turn off Firefox's same origin policy (in terms of script access, I don't really care about cross domain requests). More specifically, I want scripts in the host domain to be …

Read More
CSP: How to allow unsafe-eval for a given URI prefix (Firefox)

I'm trying to use MathJax as part of our web application which uses pretty strict Content Security Policy (CSP). The problem is that MathJax is coded to use eval() [to be exact, in form of Function()] which is not considered …

Read More