How to sanitize a HAR file

What is in a HAR file

HAR (HTTP Archive) is a JSON format for recording browser network traffic. Support teams ask for one because it shows exactly what happened. For each request it can contain:

• The full URL, including query strings such as ?token= or ?api_key=.
• Request and response headers, including Cookie, Set-Cookie and Authorization.
• The parsed cookies again, in separate cookies arrays.
• Request bodies, including the password you typed if you signed in while recording.
• Response bodies: account details, API responses, sometimes OAuth tokens.
• The IP address of the server that answered.

The session cookie is the dangerous part. It is what keeps you signed in, so whoever has a valid one can use your session without your password or second factor, until the session ends.

What Chrome's sanitized export removes

Chrome DevTools exports a sanitized HAR by default. According to the Network panel reference, it leaves out the Cookie, Set-Cookie and Authorization headers. To export them you have to turn on Allow to generate HAR with sensitive data in the DevTools network preferences.

That is a good start, but everything else stays: tokens in URLs, API keys in custom headers like X-Api-Key, passwords in request bodies and personal data in responses. Other browsers and older versions may export everything, so check the file before you send it.

Clean headers and cookies with jq

This jq command replaces sensitive headers and empties the cookie arrays in every entry:

jq '(.log.entries[].request.headers[], .log.entries[].response.headers[])
      |= (if (.name | test("^(authorization|cookie|set-cookie|x-api-key)$"; "i")) then .value = "REDACTED" else . end)
    | .log.entries[].request.cookies = []
    | .log.entries[].response.cookies = []' in.har > clean.har

If the support team does not need the bodies, empty those too. It also makes the file much smaller:

jq '(.log.entries[].request.postData | select(.) | .text) = "" | .log.entries[].response.content.text = ""' clean.har > small.har

Mask what is left with PasteSafe

A HAR file is text, so you can drop it straight onto the PasteSafe editor. It is read on your device and scanned in your browser. Here is a trimmed HAR entry. Before highlights what PasteSafe finds, After is its exact output:

{
  "request": {
    "method": "POST",
    "url": "https://api.example.com/v1/login?api_key=Qm9vbGVhbkZha2VLZXkxMjM0NTY3OA",
    "headers": [
      { "name": "Authorization", "value": "Bearer FakeBearer7fK2mZpL9wR3nB8vT1yCq" },
      { "name": "Cookie", "value": "sessionid=9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c; theme=dark" }
    ],
    "postData": {
      "mimeType": "application/json",
      "text": "{\"email\":\"jane.doe@example.com\",\"password\":\"Tr0ub4dor-3x\"}"
    }
  },
  "serverIPAddress": "198.51.100.7"
}

{
  "request": {
    "method": "POST",
    "url": "https://api.example.com/v1/login?api_key=API_KEY_1",
    "headers": [
      { "name": "Authorization", "value": "Bearer BEARER_TOKEN_1" },
      { "name": "Cookie", "value": "sessionid=9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c; theme=dark" }
    ],
    "postData": {
      "mimeType": "application/json",
      "text": "{\"email\":\"EMAIL_1\",\"password\":\"Tr0ub4dor-3x\"}"
    }
  },
  "serverIPAddress": "IP_1"
}

The Bearer token, the API key in the URL, the email and the server IP are masked. Two things are not: the password inside the escaped JSON request body, and the sessionid cookie with a plain hex value. The jq commands above take care of both, which is why it makes sense to run them first.

1. Export a sanitized HAR, then run the jq commands.
2. Drop the file onto PasteSafe. HAR files with bodies are often several megabytes. PasteSafe handles that, but above 300 KB it shows the result as plain text without highlights.
3. Search the cleaned text for your own email, user name and anything from the pages you visited that you would not want shared.
4. Copy the cleaned text, save it as a new file with the .har extension, and send that.

What PasteSafe does not catch in a HAR file

• Passwords and tokens inside escaped JSON strings, such as the request body in postData.text.
• Cookie header values that hold several cookies, like the one in the example.
• Personal data without a fixed format in response bodies: names, addresses, order details.
• Anything inside base64 encoded bodies.