Network debugging privacy
Cookie and HAR inspection: keep credentials out of shared reports
A network log is useful evidence, but it can also carry the access needed to act as a user. Local inspection does not make an unreviewed raw file safe to share.
Content updated: · Maintainer and corrections
Choose the right header direction
Cookie is a request field containing cookie name/value pairs. Set-Cookie is a response field with one cookie and its attributes. Keep separate Set-Cookie lines separate: the comma in an Expires date is not a safe cookie separator.
Secure, HttpOnly, SameSite and name prefixes describe constraints, not a complete session-security assessment. Acceptance also depends on the response origin, browser settings, storage and current implementation. This inspector does not install a cookie or simulate a cookie jar, partitioning or third-party restrictions.
Sanitized is not the same as anonymous
Chrome can export a sanitized HAR that removes familiar sensitive headers. Still inspect URLs, query parameters, request data, response content and custom fields: any of them can contain secrets or personal data. Prefer a synthetic reproduction and your organization's approved handling process.
The local tool masks values by default and exports a masked report rather than the raw HAR. Temporarily revealing values is only a local inspection action; it does not unmask the exported report. Even a masked report can retain operational metadata, so review it before sharing.
Unknown timing is not zero time
HAR timing uses milliseconds; omitted or -1 optional phases are unavailable or not applicable. SSL time can already be included in connect, so adding it again double-counts. A waterfall describes the captured entries, not every packet, server action or user-visible delay.
The inspector does not request the recorded URLs, render response HTML or replay mutations. If a log is incomplete, malformed or over the stated limits, use the error or warning as a reason to inspect the capture rather than silently inventing missing measurements.
Data provenance