Glass Headers: Modify HTTP Headers

Modify HTTP request and response headers per profile, on the sites you choose. No telemetry, no injected script, local storage only.

Glass Headers modifies the HTTP headers of requests and responses in Chrome, for web developers and testers. What it does • Start in one click: four ready-made profiles (permissive CORS, API token, no cache, mobile browser), an import of your ModHeader profiles, or an empty profile. • Profiles: keep several sets of rules, one active at a time, and pause everything in one click. Each profile has its own colour, which the toolbar badge takes when it is active. Duplicate a profile to try a variant. • Suggested keyboard shortcuts: Alt+Shift+O pauses or resumes, Alt+Shift+F switches to the next profile. Chrome may leave a suggested shortcut unassigned, for example when another extension already uses it; you can set or change both at chrome://extensions/shortcuts. • Rules: for requests or responses, set, remove or append a header. Each rule can be switched on or off. • URL filter per profile, with a type for each entry: domain (subdomains included), host:port (any scheme, WebSocket included), or advanced URL patterns and regular expressions, always flagged with a warning. No filter means all URLs. • Request types per profile: all requests, API calls only (fetch and XHR), or the types you choose. • "Only from these sites": optionally limit a profile to requests started by the sites you list. A warning appears when a profile sends an Authorization, Cookie, token, key or secret header without this limit. • Quick popup to switch profile, turn rules on or off and pause, with token values masked until you ask to see them; a full-page editor for everything else. The badge shows how many rules are in effect, in the profile's colour; the icon turns grey when paused. • Clear errors: when Chrome refuses a rule (for example, appending to a request header that Chrome does not allow), that rule is not applied and is flagged, and the others keep working. • Import and export your profiles as JSON. Profiles exported from ModHeader can be imported too. • "Copy diagnostic" for bug reports: versions, counts and error codes only, never a header value, filter, site or profile name. • English and French interface, light and dark theme, keyboard navigation. • Free, with no limit on profiles or rules set by a paid tier: there is none. The only caps are technical (200 profiles, 500 rules per profile, and Chrome's own rule limits). Built to be checked, not trusted blindly • The extension's own code sends no request: its Content Security Policy blocks fetch, XMLHttpRequest and WebSocket from its pages and its service worker, and a test forbids any call that could send a request or open a page. You can read the policy in the manifest. • No script is injected into the pages you visit. • The headers you configure are added only to the requests your browser sends to the sites you target. • Nothing sent to the publisher, no analytics, no telemetry, no remote code. The shipped code is not minified, so it can be read. • Your header values (which may contain tokens) are stored only on this device, in Chrome's local extension storage. They are never synced. Permissions • "Read and change all your data on all websites": required by Chrome to modify headers on the sites you choose in your filters. The extension only uses it through declarativeNetRequest rules. • Storage: to save your profiles locally. Exports contain your header values in clear text; store exported files with care. Contact: contact@antwork.fr Useful? A rating on the Chrome Web Store helps other developers find it. https://chromewebstore.google.com/detail/gmdkndkjchngmfgccnhbibdfdpaflhbo/reviews