Request Headers (including CORS) Modifier Chrome extension security report

👨🏻‍💻 This Extension is intended for developers and it modifies Request Headers, either through the extension’s main icon or via an exposed API. The API can be accessed from the console or sideloaded scripts (such as Tampermonkey), making it ideal for automated workflows. 💻 The API includes enable() and disable() methods for toggling header modifications directly from the global namespace. You can also add, remove and clear either hostnames or headers, and the passed data can be strings, arrays, objects (for the headers) or arrays of objects. Methods include addHostname, addHostnames, removeHostname, removeHostnames, clearHostnames, addHeader, addHeaders, removeHeader, removeHeaders, clearHeaders. All API methods return a Promise that resolves to a boolean indicating success (true) or failure (false). 👉 API Usage: The extension exposes a global API object window.requestHeaderModifier that allows you to control its functionality programmatically from your browser's developer console, a website's script (if allowed by CSP), or user script managers like Tampermonkey. All API methods return a Promise that resolves to a boolean indicating success (true) or failure (false). 📖 enable window.requestHeaderModifier.enable(); // Enables the header modification functionality. This will apply the currently saved rules. Returns true on success 📖 disable window.requestHeaderModifier.disable(); // Disables the header modification functionality. This will clear all active rules. Returns true on success 📖 addHostname window.requestHeaderModifier.addHostname(hostname); // Adds a new hostname to the list of target hostnames. If the hostname already exists, no change is made. 🔤 Parameter: hostname (string): The hostname to add (e.g., "api.example.com"). ✍️ examples: await window.requestHeaderModifier.addHostname("newapi.domain.com"); // Adds "newapi.domain.com" await window.requestHeaderModifier.addHostname("api.another.net"); // Adds "api.another.net" 📖 addHostnames window.requestHeaderModifier.addHostnames(hostnames); // Adds multiple hostnames to the list of target hostnames. Duplicate hostnames will be ignored. 🔤 Parameter: hostnames (string[]): An array of hostnames to add (e.g., ["app.domain.com", "app.example.com"]). ✍️ example: await window.requestHeaderModifier.addHostnames([ "api.test.com", "localhost:3000", ]); // Returns true on success 📖 removeHostname window.requestHeaderModifier.removeHostname(hostname); // Removes a specific hostname from the list of target hostnames. 🔤 Parameter: hostname (string): The hostname to remove. ✍️ example: await window.requestHeaderModifier.removeHostname("newapi.domain.com"); // Removes "newapi.domain.com" 📖 removeHostnames window.requestHeaderModifier.removeHostnames(hostnames); // Removes multiple hostnames from the list of target hostnames. Hostnames not found will be ignored. 🔤 Parameter: hostnames (string[]): An array of hostnames to remove. ✍️ example: await window.requestHeaderModifier.removeHostnames([ "api.old.com", "dev.api.net", ]); // Returns true if any hostnames were removed, false otherwise 📖 clearHostnames window.requestHeaderModifier.clearHostnames(); // Clears all hostnames from the list, effectively disabling header modification for all domains until new hostnames are added. ✍️ example: await window.requestHeaderModifier.clearHostnames(); // Clears all hostnames 📖 addHeader window.requestHeaderModifier.addHeader(header); // Adds a new custom request header or updates an existing one if a header with the same name already exists. 🔤 Parameter: header (string | object): The header to add. String format: "Header-Name: Header-Value" (e.g., "X-Custom-Auth: mytoken123") Object format: { "headerName": "headerValue" } (e.g., { "X-Client-ID": "app-123" }) ✍️ examples: // Using string format await window.requestHeaderModifier.addHeader("X-My-Header: MyValue"); // Using object format await window.requestHeaderModifier.addHeader({ "Content-Type": "application/json", }); // Updating an existing header (will overwrite "MyValue" with "NewValue") await window.requestHeaderModifier.addHeader("X-My-Header: NewValue"); 📖 addHeaders window.requestHeaderModifier.addHeaders(headers); // Adds multiple request headers to the list. If headers with the same names exist, their values will be updated. 🔤 Parameter: headers ((string | object)[]): An array of headers to add. Each element can be a string like "Header-Name: Header-Value" or an object like { "headerName": "headerValue" }. ✍️ examples: // Using string format array await window.requestHeaderModifier.addHeaders([ "X-My-Header: Value1", "Y-My-Header: Value2", ]); // Returns true on success // Using object format array await window.requestHeaderModifier.addHeaders([ { "Content-Type": "application/json" }, { "Accept-Language": "en-US" }, ]); // Returns true on success // Mixing formats and updating existing await window.requestHeaderModifier.addHeaders([ "Cache-Control: no-cache", { "X-My-Header": "UpdatedValue" }, // This will update X-My-Header if it exists ]); // Returns true on success 📖 removeHeader window.requestHeaderModifier.removeHeader(header); // Removes a specific custom request header by its name. The value part of the input is ignored for removal. 🔤 Parameter: header (string | object): The header to remove. Only the header name is considered for removal. String format: "Header-Name: AnyValue" (e.g., "X-My-Header: ignored") Object format: { "headerName": "ignoredValue" } (e.g., { "Content-Type": "ignored" }) ✍️ examples: // Using string format await window.requestHeaderModifier.removeHeader("X-My-Header: something"); // Removes X-My-Header // Using object format await window.requestHeaderModifier.removeHeader({ "Content-Type": "whatever" }); // Removes Content-Type 📖 removeHeaders window.requestHeaderModifier.removeHeaders(headers); // Removes multiple request headers from the list. Only the header name is considered for removal. Headers not found will be ignored. 🔤 Parameter: headers ((string | object)[]): An array of headers to remove. Each element can be a string like "Header-Name: AnyValue" or an object like { "headerName": "ignoredValue" }. ✍️ examples: // Using string format array await window.requestHeaderModifier.removeHeaders([ "X-Old-Header: anything", "Another-Header", ]); // Returns true if any headers were removed, false otherwise // Using object format array await window.requestHeaderModifier.removeHeaders([ { Authorization: "some-token" }, { Accept: "application/xml" }, ]); // Returns true if any headers were removed, false otherwise 📖 clearHeaders window.requestHeaderModifier.clearHeaders(); // Clears all custom request headers from the list. ✍️ example: await window.requestHeaderModifier.clearHeaders(); // Clears all custom headers ----------- 🥷 GitHub / Source - https://github.com/lvladikov/request-header-modifier-chrome-extension