HAR Sensitive Fields: What Your HAR Files Leak

Why HAR Files Are a Credential Leak

A HAR file is a complete record of every credential your browser sent during a recording session. Session cookies, API keys, Bearer tokens, passwords in POST bodies, OAuth codes in URL query parameters. All of it sits in the file unencrypted. Browser DevTools have no built-in redaction filter. Chrome and Firefox export everything visible in the Network tab.

When you share an unsanitized HAR with a support engineer, a QA tester, or attach it to a public bug report, you are handing over the exact data needed to impersonate a user session. The 2023 Okta breach started this way. An attacker gained access to HAR files from support sessions, extracted cookies, and replayed them to access customer tenants.

What a HAR File Captures

When you record a HAR in Chrome DevTools, it captures:

• Full request URLs (including query parameters)
• All request headers
• Request bodies (form data, JSON payloads)
• All response headers
• Response bodies (HTML, JSON, images)
• Cookies sent and received
• Timing data for each request

The file is useful for debugging network issues. The problem is that it captures everything, including the fields that carry credentials.

The Fields That Leak Credentials

Cookie Headers

The Cookie header in requests contains session tokens, authentication cookies, CSRF tokens, and tracking identifiers. Session cookies are especially dangerous because they grant immediate access to a user’s account.

{
  "name": "Cookie",
  "value": "session_id=abc123def456; csrf_token=xyz789; auth_token=eyJhbGc..."
}

The Set-Cookie header in responses may also contain sensitive values and flags:

{
  "name": "Set-Cookie",
  "value": "session_id=abc123def456; Path=/; HttpOnly; Secure; SameSite=Strict"
}

Authorization Headers

The Authorization header carries Bearer tokens, Basic auth credentials, and API keys:

{
  "name": "Authorization",
  "value": "Bearer eyJhbGciOiJSUzI1NiIs..."
}

{
  "name": "Authorization",
  "value": "Basic dXNlcjpwYXNzd29yZA=="
}

Basic auth is base64-encoded, not encrypted. The decoded value is user:password.

Request Bodies

POST and PUT request bodies often contain credentials:

{
  "username": "admin@example.com",
  "password": "s3cr3t",
  "credit_card": "4111111111111111"
}

API responses may also return sensitive data in the body:

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4",
  "user": {
    "email": "admin@example.com",
    "ssn": "123-45-6789"
  }
}

Query Parameters

URLs with tokens in query strings appear in HAR files:

https://api.example.com/auth/callback?code=abc123&state=xyz789&redirect_uri=https://app.example.com

Authorization codes and state parameters in OAuth flows are sensitive. They can be replayed to complete the authentication flow.

The Okta Breach: A Real Example

In October 2023, Okta disclosed that an attacker gained access to HAR files from Okta support sessions. The HAR files contained session tokens that the attacker used to access customer tenants. The attacker extracted cookies and headers from the HAR data and replayed them to impersonate authenticated users.

How to Redact HAR Files

Automated Redaction

The HAR Viewer tool can highlight fields that likely contain sensitive data. Look for:

• Headers named Cookie, Authorization, Set-Cookie, or any header containing token, key, secret, password, or auth
• Query parameters containing code, token, state, session, or key
• Request/response bodies containing password, token, secret, access_token, or refresh_token

Manual Redaction

Open the HAR file in a text editor and replace sensitive values:

// Before
{
  "name": "Authorization",
  "value": "Bearer eyJhbGciOiJSUzI1NiIs..."
}

// After
{
  "name": "Authorization",
  "value": "Bearer [REDACTED]"
}

For cookies, replace the entire value:

{
  "name": "Cookie",
  "value": "[REDACTED]"
}

Scripted Redaction

For repeated sanitization, write a script:

import json

SENSITIVE_HEADERS = {"authorization", "cookie", "set-cookie", "proxy-authorization"}
SENSITIVE_QUERY_PARAMS = {"code", "token", "state", "session", "key", "secret"}

def sanitize_har(har_path):
    with open(har_path) as f:
        har = json.load(f)

    for entry in har["log"]["entries"]:
        # Redact request headers
        for header in entry["request"]["headers"]:
            if header["name"].lower() in SENSITIVE_HEADERS:
                header["value"] = "[REDACTED]"

        # Redact response headers
        for header in entry["response"]["headers"]:
            if header["name"].lower() in SENSITIVE_HEADERS:
                header["value"] = "[REDACTED]"

        # Redact sensitive query params
        if "queryString" in entry["request"]:
            for param in entry["request"]["queryString"]:
                if param["name"].lower() in SENSITIVE_QUERY_PARAMS:
                    param["value"] = "[REDACTED]"

    return har

Before Sharing a HAR File

Checklist:

1. Search for Authorization headers and redact them
2. Search for Cookie headers and redact them
3. Search for Set-Cookie response headers and redact them
4. Check query parameters for tokens, codes, and session identifiers
5. Scan request and response bodies for passwords, tokens, and PII
6. Use HAR Viewer to load and inspect the file before sharing
7. Verify no credentials remain by searching for common patterns (Bearer, eyJ, password, secret, token)