Prevent ERR_BLOCKED_BY_XSS_AUDITOR in Chrome

Question

I have the following setup:

GET /foo - Displays a form with a text area containing markup that places in /bar

POST /bar - generates an ERR_BLOCKED_BY_XSS_AUDITOR error in Chrome (recently launched)

How can I get around this? I read that I have to use the X-XSS-Protection: 0 header to get around this, but should I send it as a request header or response header? On URL /foo or /bar alone?

Answer 1

You must send a response header on the server side. For example Node.js with Express

 res.header('X-XSS-Protection' , 0 ); 

Or for PHP

 header("X-XSS-Protection: 0");