HAR Redactor

[adam-ut]

What feature or new tool do you think should be added to DevToys?

Analyze a HAR file for secrets and replace sensitive secrets with the word REDACTED.

Why do you think this is needed?

When working with various cloud companies, they frequently request HAR files to help debug the issue. Users unknowingly send in those files insecurely or they are stored in a requestor's unsecure system. This can lead to compromised credentials and leave a company open to security breaches. A best effort redacted HAR file reduces vulnerabilities but still allows a HAR file to be useful in assisting debugging complicated web troubleshooting.

Solution/Idea

Things that could be detected and redacted:

• The signature of a JWT
• Known/common query string parameters that contain a secret
• Known variables used for Azure/AWS IAM based API access

Comments

No response