HAR File Sanitizer

Understanding HAR Files and Network Privacy

When developing web applications, troubleshooting API performance, or debugging complex network issues, developers frequently rely on HTTP Archive (HAR) files. A HAR file is a standardized JSON-formatted log that records every network interaction between a web browser and a server during a specific session. While incredibly useful for diagnosing bottlenecks and broken scripts, these files inadvertently capture highly sensitive user data. Because grading policies and debugging workflows vary across different engineering teams, establishing a secure protocol for handling network logs is paramount. The RapidCalc HAR Sanitizer ensures that you can share comprehensive network data without compromising session security.

What is a HAR File?

The HTTP Archive format defines an archival standard for recording HTTP transactions. It is supported by the developer tools of all major web browsers, including Google Chrome, Mozilla Firefox, and Apple Safari, as well as proxy tools like Charles and Fiddler. When you record a session and export a HAR file, the browser packages the entire sequence of HTTP requests and responses, along with their timings, sizes, and headers, into a single, structured JSON document.

These files are indispensable for third-party support teams. If you experience an issue with a SaaS platform, their engineers will often request a HAR file to replicate the sequence of events. It allows them to see exactly which API endpoint failed, what payload was sent, and how the server responded. However, because the recording is indiscriminate, it captures everything traversing the network layer.

The Anatomy of an HTTP Archive

A standard HAR file is constructed as a massive JSON object with a root log node containing an array of entries. Each entry represents a single HTTP request-response cycle and includes several critical components:

• Request Object: Contains the HTTP method (GET, POST), the exact URL, query string parameters, all outgoing headers, and cookies attached by the browser. If it is a POST or PUT request, it will also include the postData containing the payload body.
• Response Object: Details the HTTP status code (e.g., 200 OK, 404 Not Found), the incoming headers (including Set-Cookie directives), and the content payload returned by the server.
• Timings: Granular millisecond metrics breaking down DNS resolution time, TCP connection time, TLS handshakes, waiting time (TTFB), and content download time.
• Cache: Information about whether the resource was served from the browser's local cache or fetched dynamically from the remote origin.

Identifying Sensitive Information

The primary security risk of sharing a raw HAR file is the exposure of authentication credentials and session hijacking vectors. Because the file records the literal HTTP strings sent to the server, it contains the exact keys required to impersonate the user. The following fields are commonly targeted during sanitization:

Why Automated Sanitization is Critical

Manually redacting a HAR file is highly error-prone. A typical page load on a modern web application can generate hundreds of HTTP requests, resulting in a JSON file spanning tens of thousands of lines. Attempting to scroll through a text editor and manually delete Set-Cookie headers or Authorization bearer tokens almost guarantees that a critical secret will be overlooked.

Furthermore, standard find-and-replace functions are insufficient. If you simply delete a JSON node, you risk corrupting the file's strict schema, rendering it unreadable by the support engineer's diagnostic tools. A proper sanitization tool must walk the JSON tree programmatically, identify sensitive keys, and replace their values with a generic placeholder (like [REDACTED]) while maintaining the exact structural integrity of the original array.

How Client-Side Sanitization Works

The RapidCalc HAR Sanitizer operates entirely within your browser environment. This zero-server architecture is critical for data privacy. Transmitting an unsanitized HAR file to a remote server for processing would defeat the purpose of redaction, as it would expose your authentication tokens to the internet during transit.

When you load a file, the JavaScript engine parses the raw string into a DOM-accessible object. It then iterates through the log.entries array, systematically targeting the cookies and headers arrays. It applies regex matching against common security keys (such as "cookie", "authorization", "x-api-key", and "token"). When a match is found, the associated value is overwritten. The sanitized object is then serialized back into a clean JSON string, ready to be safely downloaded and shared via email or support ticket.

Best Practices for Network Debugging

While sanitization removes the most common attack vectors, security requires a defense-in-depth approach. Before recording a HAR file for a third party, it is best practice to initiate an entirely new, isolated browsing session. Open an incognito or private browsing window to ensure legacy cookies from unrelated applications are not captured in the recording. Log into the specific application, reproduce the error immediately, and stop the recording. This minimizes the scope of the log, reducing the file size and limiting the surface area of potential data exposure. Once recorded, always run the file through a local sanitizer to strip the active session identifiers before distributing the diagnostic payload.