HarGeneratorPlugin

Generates HTTP Archive (HAR) files from the intercepted requests and responses.

Configuration example

{
  "$schema": "https://raw.githubusercontent.com/dotnet/dev-proxy/main/schemas/v4.0.0/rc.schema.json",
  "plugins": [
    {
      "name": "HarGeneratorPlugin",
      "enabled": true,
      "pluginPath": "~appFolder/plugins/DevProxy.Plugins.dll",
      "configSection": "harGeneratorPlugin"
    }
  ],
  "harGeneratorPlugin": {
    "$schema": "https://raw.githubusercontent.com/dotnet/dev-proxy/main/schemas/v4.0.0/hargeneratorplugin.schema.json",
    "includeSensitiveInformation": false,
    "includeResponse": true
  }
}

Configuration properties

Property Description Default
includeSensitiveInformation Determines whether to include sensitive information (authorization headers, cookies, etc.) in the generated HAR file. When set to false, values of sensitive headers, cookies, and sensitive query parameters are redacted with the value REDACTED false
includeResponse Determines whether to include response body content in the generated HAR file false

Command line options

None

Remarks

The HAR (HTTP Archive) format is a JSON-based format for logging HTTP transactions. Various tools widely support it and used it to:

  • Analyze network traffic and performance
  • Debug API interactions
  • Share HTTP session data
  • Import into browser developer tools and other analysis tools

When includeSensitiveInformation is set to false, the plugin automatically redacts the following sensitive headers:

  • authorization
  • cookie
  • from
  • proxy-authenticate
  • proxy-authorization
  • set-cookie
  • www-authenticate
  • x-api-key
  • x-auth-token
  • x-csrf-token
  • x-forwarded-for
  • x-real-ip
  • x-session-token
  • x-xsrf-token

The plugin also replaces the values of all request and response cookies (request.cookies and response.cookies) with REDACTED, while keeping the cookie names.

Additionally, the plugin redacts the values of the following sensitive query parameters (case-insensitive) in both the request URL (request.url) and the query string (request.queryString). Other query parameters keep their original values.

  • access_token
  • api_key
  • api-key
  • apikey
  • auth
  • client_secret
  • code
  • id_token
  • key
  • password
  • refresh_token
  • secret
  • sig
  • signature
  • token
  • x-amz-credential
  • x-amz-security-token
  • x-amz-signature
  • x-goog-credential
  • x-goog-signature

For example, the request URL https://api.contoso.com/users?access_token=abc123&page=2 is recorded as https://api.contoso.com/users?access_token=REDACTED&page=2.

The generated HAR file includes:

  • HTTP request details (method, URL, headers, query parameters, cookies)
  • HTTP response details (status, headers, cookies)
  • Request and response body data (when applicable)
  • Content types and sizes
  • HTTP version information

The plugin creates a HAR file named devproxy-{timestamp}.har in the current directory after recording stops.

  • Last updated on