I keep creating answers to things and using the very hand code snippet function. The problem is that the snippets don't run in Google Chrome and throw this error in console:
The XSS Auditor refused to execute a script in 'http://stacksnippets.net/js' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.
Here's an example of one just created: https://stackoverflow.com/a/30077962/2117156
This seems to work in Firefox absolutely fine, however I'd rather not have to keep including JSFiddle links in my answers to cover a broken snippet.
Oh and I created the fiddle in Chrome, so it's not the code at fault.
Update 1
It doesn't work in IE either:
SEC7130: Potential cross-site scripting detected in 'http://stacksnippets.net/js'. The content has been modified by the XSS Filter.
Clicking SEC7130
takes to you to this article.
Update 2
The headers I am getting:
**General**
Remote Address:198.252.206.24:80
Request URL:http://stacksnippets.net/js
Request Method:POST
Status Code:200 OK
**Response Headers**
Cache-Control:public, max-age=42
Content-Encoding:gzip
Content-Length:766
Content-Type:text/html; charset=utf-8
Date:Wed, 06 May 2015 14:55:23 GMT
Expires:Wed, 06 May 2015 14:56:06 GMT
Last-Modified:Wed, 06 May 2015 14:55:06 GMT
Vary:*
X-AspNet-Version:4.0.30319
X-Powered-By:ASP.NET
**Request Headers**
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding:gzip, deflate
Accept-Language:en-GB,en-US;q=0.8,en;q=0.6
Cache-Control:max-age=0
Connection:keep-alive
Content-Length:2744
Content-Type:application/x-www-form-urlencoded
Host:stacksnippets.net
Origin:http://stackoverflow.com
Referer:https://stackoverflow.com/questions/30077202/find-next-previous-element/30077962
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36
They also work if there is no JavaScript in the snippet...
X-XSS-Protection: 0
header in the snippet's response. Is your Chrome going through a proxy that can eat that header?X-XSS-Protection: 0
?