Build a Deterministic HAR Sanitizer for Proxy Debugging

#security #devops #webdev

HTTP Archive files are excellent proxy-debug artifacts because they preserve request order, redirects, status codes, timing phases, and headers. They are also easy to mishandle: a full export may contain proxy credentials, cookies, bearer tokens, form values, signed URLs, customer identifiers, and response bodies.

Browser-side redaction is useful, but your release gate should be a deterministic sanitizer followed by an independent scan.

Start with a narrow capture

Use a temporary test account and isolated browser profile. Record one reproduction, not a whole browsing session. Revoke the test credential after capture. Data you never collect cannot leak from the case package.

Parse JSON instead of using regex replacement

Define blocked header names case-insensitively:

const BLOCKED_HEADERS = new Set([
  "authorization",
  "proxy-authorization",
  "cookie",
  "set-cookie",
  "x-api-key",
  "x-auth-token"
]);

function redactHeaders(headers = []) {
  return headers.map((h) => BLOCKED_HEADERS.has(h.name.toLowerCase())
    ? { ...h, value: "[REDACTED]" }
    : h);
}

Then transform each entry:

function sanitizeEntry(entry) {
  const request = entry.request ?? {};
  const response = entry.response ?? {};

  request.headers = redactHeaders(request.headers);
  response.headers = redactHeaders(response.headers);
  request.cookies = [];
  response.cookies = [];

  request.url = sanitizeUrl(request.url);
  request.queryString = sanitizeQuery(request.queryString);

  if (request.postData) request.postData = sanitizePostData(request.postData);
  if (response.content) delete response.content.text;

  return { ...entry, request, response };
}

sanitizeUrl, sanitizeQuery, and sanitizePostData need application-specific rules. Useful denylist keys include access_token, refresh_token, session, signature, code, and key. Use an allowlist for retained body fields. Drop binary, compressed, multipart, and unknown bodies.

Write output to a new filename. Never mutate the only copy and never let the sanitized file inherit a misleading original name.

Keep the evidence engineers need

Preserve, when policy permits:

request method and a sanitized origin label;
HTTP version, status code, and redirect order;
DNS, connect, TLS, send, wait, and receive timing;
transfer size and safe content type;
reviewed correlation IDs;
the failing entry and only the dependencies required to explain it.

Replace restricted hostnames with stable case labels. Store the private label map in the internal ticket, not in the shared HAR.

Validate with a second control

Treat a successful sanitizer run as untrusted output:

1. Parse the output again.
2. Search for blocked header and token field names.
3. Search for exact test identities and internal hostnames.
4. Scan common bearer, JWT-like, key, and high-entropy patterns.
5. Load the sanitized HAR in a clean profile.
6. Confirm the failure sequence is still diagnosable.

Record the ruleset version, output checksum, reviewer, and deletion date. High-risk traces should get a second human review before they leave the team.

Remember Proxy-Authorization

Many general-purpose log scrubbers check Authorization but forget Proxy-Authorization. Treat them equally. Also inspect proxy usernames in URLs, tool metadata, command annotations, and diagnostic notes.

The safest support artifact is not the trace with the most detail. It is the smallest validated trace that answers a specific question.

Disclosure: I work with 98IP, a proxy service. This tutorial is vendor-neutral. More proxy engineering resources: https://en.98ip.com/?k=dev
``

DEV Community