Disable cross domain web security in Firefox

Question

In Firefox, how do I do the equivalent of --disable-web-security in Chrome. This has been posted a lot, but never a true answer. Most are links to add-ons (some

Answer 1

I have not been able to find a Firefox option equivalent of --disable-web-security or an addon that does that for me. I really needed it for some testing scenarios where modifying the web server was not possible. What did help was to use Fiddler to auto-modify web responses so that they have the correct headers and CORS is no longer an issue.

The steps are:

1. Open fiddler.

2. If on https go to menu Tools -> Options -> Https and tick the Capture & Decrypt https options

3. Go to menu Rules -> Customize rules. Modify the OnBeforeResponseFunction so that it looks like the following, then save:

    static function OnBeforeResponse(oSession: Session) {
       //....
       oSession.oResponse.headers.Remove("Access-Control-Allow-Origin");
       oSession.oResponse.headers.Add("Access-Control-Allow-Origin", "*");
       //...
    }
   

   This will make every web response to have the Access-Control-Allow-Origin: * header.

4. This still won't work as the OPTIONS preflight will pass through and cause the request to block before our above rule gets the chance to modify the headers. So to fix this, in the fiddler main window, on the right hand side there's an AutoResponder tab. Add a new rule and response: METHOD:OPTIONS https://yoursite.com/ with auto response: *CORSPreflightAllow and tick the boxes: "Enable Rules" and "Unmatched requests passthrough".

See picture below for reference: