Browser Security – Prevent Local IP Address Leaks in Web Browsers

Here is the solution for Firefox:

1. Type the following into the Firefox address bar: about:config

2. Right-click on any value and select New > String

3. You will first be prompted for the preference name. Enter the following: capability.policy.default.HTMLInputElement.focus

4. Next, you will be prompted for the preference value. Enter the following: noAccess

That's it!

If you're not happy with the change, undoing it is a little more complicated:

1. Close Firefox if it's open by going into the File menu and choosing Exit.

2. Locate your Application Data folder. The easiest way to do this is to go to the Start menu, choose Run, and type in "%APPDATA%" (without the quotes.)

3. Navigate to your profile folder. It should be in Mozilla/Firefox/Profiles/_____.default, where the underscore is a string of random characters. Find the file called prefs.js and open it in a text editor, such as Notepad. (Do not just double-click it. You should be able to right-click it and choose Edit from the context menu.)

4. Search for the line that contains capability.policy.default.HTMLInputElement.focus. It will look like this in its entirety: user_pref("capability.policy.default.HTMLInputElement.focus", "noAccess");

5. Delete this line, and only this line. Save the file. You may now restart Firefox.

From the bug report page, the workaround mentioned in comment 12 works: In the Developer Tools, enable Resource Tracking. (If it was off, enabling it will resubmit the request that generated the currently visible page, either POST or GET.) In the list of Resources, you can click on the main page to see the source code as it was returned by sever the for both POST and GET requests.

More information

I ran some tests using a simple php file that showed the request method used and a POSTed value, a proxy server log to see which requests Chrome was making, and the chrome://net-internals/view-cache/ prefix to see what Chrome was caching.

When you use the View Source command, Chrome shows the source of its cached version of the page, and it only caches pages requested via the GET method.

If you're looking at a page that you've previously requested using GET and POST, then only the GET version is cached. Using the View Source command won't re-request the page, but will show the cached GET version, not the currently visible POST version, if any.

If you're looking at a page that you've only requested using the POST method, then using the View Source command will cause Chrome to look in its cache, find nothing, request the page using GET, cache it, and show the source of that.