HAR sharing / privacy handoff
Choose what to keep or hide before sharing a HAR
Keep only method, path and status. Remove secrets and personal data from headers, cookies, query parameters and bodies before sharing. Stop when a credential remains.
Decide by HAR location
Classify each synthetic fixture field as keep, redact before sharing, or never share. Record its location and reason together.
| Field | Class | Decision | Reason |
|---|---|---|---|
| request.method | Keep | Keep | Needed to reproduce the request type |
| request.url.path | Keep | Keep | Identifies the failing operation |
| response.status | Keep | Keep | Shows the failure class |
| authorization | Redact before sharing | Redact | May contain a credential |
| cookie | Never share | Stop | May carry a session |
| query.email | Redact before sharing | Redact | Personal identifier is not diagnostic |
| body.debug_note | Keep | Keep | Synthetic helper text only |
Make a minimal handoff
sample.har contains synthetic token, cookie and email examples. Keep only the path, status and synthetic ID for sharing, and record removed and unknown fields.
method=GET
path=/orders
status=500
error=E_SYNTHETIC
removed=authorization,cookie,query.email
unknown_sensitivity=none
Redaction is not a guarantee that every secret was found. Stop until an owner reviews unknown fields.
Check in this order
- Decide whether method, path and status are enough.
- Remove Authorization, Bearer, token, cookie and session material.
- Redact email, phone, IDs and personal data in query and body.
- Record removed fields and the reviewer in the handoff.
- Stop until the data owner reviews any field with unknown sensitivity.
This is a static browser-local guide. No real data, input or fixture is sent or stored externally.
Never share a HAR with credentials
TOKEN_EXAMPLE_ONLY, COOKIE_EXAMPLE_ONLY and person@example.test are synthetic examples, but they must not remain in a shared file. Do not paste real tokens or cookies; stop, revoke and ask the owner to review.