Sharing archives

An archive records the requests exactly as they were sent: Authorization headers, Cookie and Set-Cookie values, bearer tokens, API keys in URLs, and complete request and response bodies. Treat a .har file as a secret: do not attach one to a bug report, a support ticket or an issue, and do not commit one, before removing the sensitive data.

The library reads and writes what the file contains, and does not redact anything for you. To remove the headers and cookies that usually carry credentials, edit the model before writing it:

string[] sensitiveHeaders = ["Authorization", "Cookie", "Set-Cookie"];
foreach (var entry in document.Log?.Entries ?? [])
{
    if (entry.Request is { } request)
    {
        request.Headers?.RemoveAll(header => sensitiveHeaders.Contains(header.Name, StringComparer.OrdinalIgnoreCase));
        request.Cookies?.Clear();
    }

    if (entry.Response is { } response)
    {
        response.Headers?.RemoveAll(header => sensitiveHeaders.Contains(header.Name, StringComparer.OrdinalIgnoreCase));
        response.Cookies?.Clear();
    }
}

Then write the document as usual (see Reading and writing). Headers and cookies are not the only places secrets hide; check the rest of the archive too:

• HarRequest.Url and HarRequest.QueryString, for tokens and API keys passed in the query string.
• HarRequest.PostData, for passwords and tokens sent in a form or a JSON body.
• HarResponse.Content.Text, for tokens returned by the server.
• The headers of your own API, such as X-Api-Key.
• ExtensionData, where tools store the fields they add.