Header Ext

What Header Ext does

Header Ext uses the browser's Manifest V3 declarativeNetRequest API and compiles your configuration into native network rules. It is designed for development, integration testing, and debugging tasks such as:

• setting, appending, or removing request and response headers;
• appending Cookie to requests or Set-Cookie to responses;
• redirecting a request to a complete URL or rewriting it with regex capture groups;
• limiting rules by tab, request domain, complete request URL, method, and resource type;
• keeping separate rule sets for projects and environments in Profiles.

Header Ext is not a network logger or system proxy. It does not display traffic logs, read request or response bodies, or modify body content. Every rule remains subject to browser DNR capabilities and security restrictions.

Installation

Install from an official store for automatic updates:

• Chrome Web Store: Open ↗
• Microsoft Edge Add-ons: Open ↗
• Firefox Add-ons (AMO): Open ↗

After installation, pin Header Ext to the browser toolbar for quick Profile switching, global pause, and current-tab locking.

Manual installation

If an extension store is unavailable, download the archive for your browser from GitHub Releases ↗, extract it, and load it manually:

• Chrome / Edge: open chrome://extensions or edge://extensions, enable Developer mode, and choose “Load unpacked.”
• Firefox: open about:debugging#/runtime/this-firefox, choose “Load Temporary Add-on,” and select manifest.json.

A temporary Firefox add-on disappears after a browser restart. Use a store release for regular use.

Interface and core concepts

Popup

Open the Popup from the toolbar for everyday operations:

• select the Profile being edited and applied by default;
• create or toggle Header, Cookie, and Redirect Mods;
• inspect the number of active Profiles and rules;
• temporarily lock rules to the current tab;
• pause or resume all rules;
• open the full settings page.

Settings page

The settings page combines the complete Profile list, rule editor, and live status panel. Use it to manage scopes, variables, templates, imports, exports, and potential conflicts.

Changes are saved automatically and registered immediately. There is no separate save action.

Profiles, Mods, and Filters

• Profile: a switchable configuration set. Name Profiles after a project, environment, or purpose.
• Mod: an action that changes network behavior, such as Header, Cookie, or Redirect.
• Filter: a condition that decides which requests a Profile or Mod can affect.
• Variable: a reusable Profile-local value referenced with {{name}}.

The selected Profile is applied by default. Other Profiles can be marked always enabled so they are compiled together with the selected Profile.

Five-minute quick start

Create a request-header rule that applies only to the current site:

1. Open a normal HTTP or HTTPS page.

2. Open Header Ext and create a Profile named “Header Ext Demo.”

3. Add a Request Header Mod.

4. Enter:

   Field	Value
   Header name	X-Header-Ext-Demo
   Header value	enabled
   Operation	Set

5. Add a Request Domain Filter to the Profile and enter the current hostname, such as example.com.

6. Confirm that both the Profile and the Mod are enabled.

7. Open Developer Tools, select Network, reload the page, and inspect a request to that domain. Request Headers should include:

X-Header-Ext-Demo: enabled

Pause the Profile or use the global pause, reload again, and confirm that the Header is gone.

Modifying request and response headers

When adding a Header Mod, first select Request or Response, then choose an operation:

Set and Append require a non-empty value. Browsers restrict which request headers support Append; use Set if registration fails or the appended value is absent.

Common uses include:

• request headers for authorization, feature flags, debugging markers, or a custom User-Agent;
• response headers for CORS, CSP, caching, or iframe behavior;
• temporary removal of Content-Security-Policy or X-Frame-Options during local debugging.

Removing security headers weakens browser protections for matching traffic. Keep Filters narrow and pause the rule after testing.

Verifying response-header changes

Chromium's Network panel can show the server's original response headers even after DNR modifies them. An unchanged value in that panel does not prove that a rule failed. Run a same-origin request in the target site's Console:

const response = await fetch("/api/endpoint", { cache: "no-store" });
Object.fromEntries(response.headers.entries());

Replace /api/endpoint with an address matched by the rule.

Appending cookies

Header Ext provides two convenience Mods:

• Cookie Request Append combines the entered name and value into name=value and appends it to the request's Cookie Header.
• Set-Cookie Response Append appends the entered name and value to the response's Set-Cookie Header.

These Mods use static values entered by you. They do not read or synchronize browser cookies. Cookies often contain session credentials, so combine them with a request-domain, URL, or tab Filter.

Redirects and URL rewriting

Simple redirects

With regex disabled, enter a source URL Filter and an absolute destination beginning with http:// or https://.

Make sure the destination does not match the source again, or the rule may create a redirect loop.

Regex rewriting

Enable regex to use capture groups in the source and \1, \2, and similar back-references in the destination.

This example moves production API traffic to a local server while preserving the path:

Source regex: ^https://api\.example\.com/(.*)$
Destination: http://localhost:8787/\1

Browser DNR regex is not a complete JavaScript RegExp implementation. If registration fails, simplify the expression and avoid unsupported constructs such as lookbehind.

Scope and Filter logic

An enabled Profile without any Filter affects all requests. The settings page reports this as a global-scope risk.

Profile-level Filters include:

Multiple enabled values of the same Filter type generally use OR logic. Different Filter types use AND logic. Disabled and empty items are ignored.

Each Header Mod also has Advanced Conditions:

• a URL Filter or URL regex;
• included and excluded domains;
• resource types such as main document, XHR, script, image, or WebSocket;
• request methods.

The Profile scope and the Mod's Advanced Conditions are combined with AND logic. When debugging, test the complete resource URL rather than only the page URL in the address bar.

Temporary tab lock

“Lock to current tab” in the Popup temporarily restricts active rules to that tab. Recheck the lock after closing the tab, restarting the browser, or unlocking it manually.

Profile variables

Variables help reuse environment addresses, tokens, and common Header values:

1. Add a Profile variable named apiToken with a value such as Bearer abc123.
2. Enter {{apiToken}} in a Header, Cookie, Redirect, or Filter field.
3. Header Ext replaces the placeholder before registering DNR rules.

Variables are Profile-local. Names are trimmed, and disabled or missing variables do not produce a valid replacement.

Variable values stay in browser storage and may appear in exported JSON. Do not share configurations containing secrets without reviewing them.

Templates

The settings page can add editable Mods from these templates:

• Remove CSP removes Content-Security-Policy and its Report-Only variant;
• Open CORS adds common Access-Control-Allow-* response headers;
• Remove X-Frame-Options helps with iframe integration testing;
• Custom User-Agent replaces the request User-Agent;
• Disable cache sets Cache-Control and Pragma.

Templates are starting points. Add Filters after applying one so it does not affect every request.

Profile composition and conflicts

• The selected Profile is applied by default.
• Always-enabled Profiles are compiled with the selected Profile.
• Global pause temporarily removes all registered rules without deleting configuration.
• Disabling an individual Mod or Filter affects only that item.

If multiple active Profiles modify the same Header or redirect the same request, they can conflict. The live status panel reports potential conflicts. Narrow the scope, disable duplicates, or split the rules into non-overlapping Profiles.

Importing, exporting, and sharing

Export

Open Share in the settings page, select the Profiles to include, then:

• copy JSON to the clipboard; or
• download header-ext-config.json.

Review Header, Cookie, variable, and Redirect values for tokens, sessions, internal hosts, or other private data. Header Ext does not redact them automatically.

Import

Paste exported Header Ext JSON or import a file. Valid Profiles are merged with the existing configuration rather than replacing it. Internal rule IDs are regenerated to avoid collisions.

After importing, review:

1. which Profiles and Mods are enabled;
2. whether Filters match the current device and environment;
3. whether cookies, variables, and internal addresses need replacement;
4. whether the status panel reports global-scope risks or potential conflicts.

Troubleshooting

A rule is not applied

Check the configuration from top to bottom:

1. Header Ext is not globally paused.
2. The selected or always-enabled Profile and target Mod are enabled.
3. The Header name is non-empty, and Set or Append has a value.
4. Every enabled Profile Filter type matches the request.
5. Advanced Conditions do not exclude the request.
6. You are testing the complete request URL, correct method, and resource type.
7. The regex is supported by browser DNR.
8. No other Profile or network-modifying extension conflicts with the rule.

The scope is too broad

If the status panel reports a global-scope risk, add at least a Request Domain or Tab Filter. Sensitive Mods such as authorization Headers, cookies, and removed security Headers should normally combine domain and URL conditions.

Configuration looks correct but rule state is stale

Use global pause and resume, or disable and re-enable the target Mod to force recompilation. If the problem remains, export a backup, reload the extension, and inspect the browser's extension error page.

Data, permissions, and privacy

• Profiles, rules, variables, and preferences are stored in browser storage.local.
• The extension uses declarativeNetRequest to register network rules.
• Host access is required so configured sites can be matched.
• No content script is injected, and page content or request/response bodies are not read.
• No remote analytics, advertising, or configuration-sync service is included.

Uninstalling the extension removes its browser-managed local data. Export important Profiles regularly.

Theme and language

• Theme options are System, Light, and Dark.
• Simplified Chinese and English are included.
• Before a manual choice, language follows the browser and theme follows the operating system.