117

I'm developing a local research tool that requires me to turn off Firefox's same origin policy (in terms of script access, I don't really care about cross domain requests).

More specifically, I want scripts in the host domain to be able to access arbitrary elements in any iframes embedded in the page, regardless of their domain.

I'm aware previous Q&As which mentioned the CORS FF extension, but that is not what I need, since it only allows CORS, but not script access.

If it cannot be done easily, I would also appreciate any insights that point me to specific part of FF src code that I can modify to disable SOP, so that I can recompile FF.

Elrond_EGLDer
  • 47,430
  • 25
  • 189
  • 180
Yuchen Zhou
  • 1,409
  • 2
  • 11
  • 11
  • 4
    It would be an interesting thing with developers. Since the same origin policy is designed for the security of the users and not the developers, it should be made possible to allow the scripts from the **given** site to go across the restrictions. But developers are also people, so you could loose your personal information as well. – Danubian Sailor Jun 25 '13 at 11:16
  • 1
    I believe it's not possible right now, here is related bug report in Firefox Bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1039678 – rutsky Oct 09 '14 at 16:13
  • Only good solution is to inject the headers by plugin based on domains: https://stackoverflow.com/a/44093160/956397 Everthing else is insecure... – PiTheNumber Jul 15 '19 at 10:21

7 Answers7

88

There's a Firefox extension that adds the CORS headers to any HTTP response working on the latest Firefox (build 36.0.1) released March 5, 2015. I tested it and it's working on both Windows 7 and Mavericks. I'll guide you throught the steps to get it working.

1) Getting the extension

You can either download the xpi from here (author builds) or from here (mirror, may not be updated).

Or download the files from GitHub. Now it's also on Firefox Marketplace: Download here. In this case, the addon is installed after you click install and you can skip to step 4.

If you downloaded the xpi you can jump to step 3. If you downloaded the zip from GitHub, go to step 2.

2) Building the xpi

You need to extract the zip, get inside the "cors-everywhere-firefox-addon-master" folder, select all the items and zip them. Then, rename the created zip as *.xpi

Note: If you are using the OS X gui, it may create some hidden files, so you 'd be better using the command line.

3) Installing the xpi

You can just drag and drop the xpi to firefox, or go to: "about:addons", click on the cog on the top right corner and select "install add on from file", then select you .xpi file. Now, restart firefox.

4) Getting it to work

Now, the extension won't be working by default. You need to drag the extension icon to the extension bar, but don't worry. There are pictures!

  • Click on the Firefox Menu
  • Click on Customise

p1

  • Drag CorsE to the bar
  • Now, click on the icon, when it's green the CORS headers will be added to any HTTP response

p2

5) Testing if it's working

jQuery

$.get( "http://example.com/", function( data ) {
  console.log (data);
});

JavaScript

xmlhttp=new XMLHttpRequest();

xmlhttp.onreadystatechange = function() {
    if (xmlhttp.readyState == 4) {
        console.log(xmlhttp.responseText);
    }
}

xmlhttp.open("GET","http://example.com/");
xmlhttp.send();

6) Final considerations

Note that https to http is not allowed.

There may be a way around it, but it's behind the scope of the question.

German Lashevich
  • 1,731
  • 21
  • 30
Giacomo Tecya Pigani
  • 2,027
  • 22
  • 33
  • 2
    You can disable HTTP/HTTPS mixed content protection by setting `security.mixed_content.block_active_content` to **false** and `security.mixed_content.block_display_content` to **true**. Keep in mind you are disabling some security and this should be a temporary solution. – bufh Jun 05 '15 at 15:11
  • 4
    As the author of this addon, I'm not actually convinced it would solve this particular question. It's nice to get a mention though. – spenibus Jul 13 '15 at 23:02
  • 2
    @spenibus - you should get your add on signed - I can't install it :( - https://support.mozilla.org/en-US/kb/add-on-signing-in-firefox?as=u&utm_source=inproduct – Peter Ajtai Sep 10 '15 at 05:42
  • 3
    @PeterAjtai Mozilla keeps on trying hard to annoy me I see. Awaiting review: https://addons.mozilla.org/en-US/firefox/addon/cors-everywhere/ Should hopefully get auto signed. – spenibus Sep 10 '15 at 11:21
  • doesnt work for me. CorsE icon is green, but XmlHttpRequest returns just empty String for example.com or google.com. It works for a file on localhost - so the example script should be ok. – Alex Feb 19 '16 at 08:02
  • 1
    in about:config set **xpinstall.signatures.required** to **false** to install the addon. It worked for me. – user2345998 Feb 27 '16 at 09:33
  • Use Chrome because it's so much easier to disable CORS for developing. – Pete Alvin May 29 '16 at 12:21
  • https://addons.mozilla.org/de/firefox/addon/cors-everywhere/ This is the addon mentioned above. It works great. – Type-Style Sep 23 '16 at 07:41
  • My addon also work with the latest version of Firefox too. With better UI and support JS regex. Check it out here: https://addons.mozilla.org/en-US/firefox/addon/cross-domain-cors – Tan Mai Van May 21 '17 at 04:24
  • @spenibus This is a really useful tool. Any plans for making it work on the new FF version? – wizzwizz4 Jan 17 '18 at 20:03
  • @wizzwizz4 I switched to the WebExtensions API around 6 months ago, it should work unless Mozilla already broke compatibility, which I wouldn't know since I've stopped updating Firefox and nobody opened an issue on the tracker. Perhaps you missed the marketplace link ? https://addons.mozilla.org/firefox/addon/cors-everywhere/ – spenibus Jan 17 '18 at 20:36
  • @spenibus It disappeared from my Firefox when I got Quantum. I installed it through that. (Review link: https://addons.mozilla.org/en-GB/firefox/addon/cors-everywhere/reviews/?src=api) – wizzwizz4 Jan 17 '18 at 21:27
  • What. I just reinstalled it... and it works. And now it's gone from the Legacy Extensions list. I blame cosmic rays. – wizzwizz4 Jan 17 '18 at 21:29
49
about:config -> security.fileuri.strict_origin_policy -> false
Niklas
  • 18,855
  • 28
  • 114
  • 153
  • 21
    Thanks @Niklas, however, i think this only disables fileuri same origin policy checks - probably used for local web dev testing. It still stops me when I'm trying to access DOM nodes in an iframe with domain B from a JavaScript in domain A. – Yuchen Zhou Sep 19 '13 at 16:38
  • 137
    this doesn't do anything – vknyvz Jun 23 '14 at 16:46
  • As vknyvz says, it is useless – eversor Mar 11 '15 at 13:48
  • 2
    Confirmed it does work in my firefox (developer) version: 40. Thank you for the tip @Niklas. – bufh Jun 05 '15 at 15:12
  • Just found about `XOriginPolicy`, `sendRefererHeader`, `spoofSource` which may be useful for *testing purposes* bypassing CORS and all (sources: [ghacks.net](http://www.ghacks.net/2015/01/22/improve-online-privacy-by-controlling-referrer-information/), [b.agilob.net](http://b.agilob.net/better-security-privacy-and-anonymity-in-firefox/)). – bufh Jun 08 '15 at 08:44
  • 12
    This is a setting specifically for debugging, and controls a local files access to other local files (set to true a local file can only access local files in the same folder or sub folders, set to false a local file can access all local files). [Source](http://kb.mozillazine.org/Security.fileuri.strict_origin_policy) – Jon Egerton Sep 21 '15 at 10:08
  • 1
    Easiest workaround for CSS rules referencing local files, such as `@font-face { url(local/path); ... }` – sphakka Apr 27 '19 at 14:08
  • 7
    It *does* do something, in my case it allows me to access local resources from a document served over `file://` protocol. Computer scientists ought to put more weight into the word "anything" -- unless you have tested *everything* (which you haven't), try to be more conservative with your remarks. Same goes for use of word "useless". – amn May 16 '19 at 11:21
  • 1
    As someone trying to solve the problem of blocked `fetch` requests in Firefox Developer Edition when debugging locally, this didn't work for me. – Tim Daubenschütz Dec 03 '20 at 12:55
  • It crashed my Firefox when after making the change I tried to reload the local file that was the problem. – Panu Logic Mar 07 '21 at 17:19
12

I realized my older answer is downvoted because I didn't specify how to disable FF's same origin policy specifically. Here I will give a more detailed answer:

Warning: This requires a re-compilation of FF, and the newly compiled version of Firefox will not be able to enable SOP again.

Check out Mozilla's Firefox's source code, find nsScriptSecurityManager.cpp in the src directory. I will use the one listed here as example: http://mxr.mozilla.org/aviarybranch/source/caps/src/nsScriptSecurityManager.cpp

Go to the function implementation nsScriptSecurityManager::CheckSameOriginURI, which is line 568 as of date 03/02/2016.

Make that function always return NS_OK.

This will disable SOP for good.

The browser addon answer by @Giacomo should be useful for most people and I have accepted that answer, however, for my personal research needs (TL;won't explain here) it is not enough and I figure other researchers may need to do what I did here to fully kill SOP.

Yuchen Zhou
  • 1,409
  • 2
  • 11
  • 11
  • Line 499 as of today, Git mirror: https://github.com/mozilla/gecko-dev/blob/326e14fb760b2bdcdaa6b317ed38c7ef2ac34fdd/caps/nsScriptSecurityManager.cpp – kamranicus Jul 28 '20 at 04:06
9

I wrote an add-on to overcome this issue in Firefox (Chrome, Opera version will have soon). It works with the latest Firefox version, with beautiful UI and support JS regex: https://addons.mozilla.org/en-US/firefox/addon/cross-domain-cors

enter image description here

Tan Mai Van
  • 579
  • 5
  • 7
  • 1
    Thanks you. Additionally, there's also [CORS-Everywhere Extension](https://addons.mozilla.org/en-US/firefox/addon/cors-everywhere/) which is similar. – nachtigall Feb 23 '18 at 10:43
  • It's not working. I tried enabling it and I still get an error saying "Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource". – Donald Duck Apr 19 '21 at 15:21
3

As of September 2016 this addon is the best to disable CORS: https://github.com/fredericlb/Force-CORS/releases

In the options panel you can configure which header to inject and specific website to have it enabled automatically.

enter image description here

Khado Mikhal
  • 482
  • 4
  • 14
  • 1
    From https://wiki.mozilla.org/Add-ons/Extension_Signing: Firefox 48: Release and Beta versions of Firefox for Desktop will not allow unsigned extensions to be installed, with no override. I could not find a signed version of this addon. – FelixM May 10 '17 at 15:33
  • 1
    @FelixM Here's how to do it: https://www.ghacks.net/2016/08/14/override-firefox-add-on-signing-requirement/ – Khado Mikhal May 10 '17 at 19:49
  • @FelixM Firefox Developer Edition has an option "xpinstall.signatures.required" boolean in the "about:config" flags. However, version 0.1.1 of this extension is not compatible with Firefox Developer Edition 58.0 (Quantum). – alxndr Nov 29 '17 at 23:58
2

The cors-everywhere addon works for me until Firefox 68, after 68 I need to adjust 'privacy.file_unique_origin' -> false (by open 'about:config') to solve 'CORS request not HTTP' for new CORS same-origin rule introduced.

Aaroninus
  • 971
  • 2
  • 15
  • 35
ob.yann
  • 236
  • 3
  • 6
0

In about:config add content.cors.disable (empty string).

double-beep
  • 3,889
  • 12
  • 24
  • 35
ghst
  • 17
  • 1
  • 1
    Has this been tested? From what I'm reading, this pref was designed to make all CORS requests fail when set to `true`, but says nothing about `false` or other values. _"In Firefox, the preference that disables CORS is content.cors.disable. Setting this to true disables CORS, so whenever that's the case, CORS requests will always fail with this error."_ https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSDisabled – stealththeninja Jun 11 '20 at 01:10
  • As of Firefox 68.7 this setting is not even available. – Gunnar Bernstein Jun 18 '20 at 08:58
  • Found this setting in FF 84 but it didn't help me overcome my issue of FF wanting valid CORS policy to foreign server. – Tim Daubenschütz Dec 03 '20 at 12:58
  • in FF85 `content.cors.disable` exists, but its boolean, remove/edit is not possible – a55 Dec 03 '20 at 16:55