HDrop — Tab Header Injector

Inject custom HTTP headers into specific tabs.

HDrop lets you set custom HTTP request headers on the exact tabs you choose — and nothing else. It's built for developers and QA engineers who spend their day flipping the same request between environments. Instead of running a proxy, editing code, or signing in and out of accounts, you add a header once and toggle it on for the tab you're testing in. WHY PER-TAB MATTERS Most header tools apply rules to your whole browser. HDrop is opt-in per tab or per window. A tab you haven't explicitly turned on is completely untouched — normal browsing, normal requests, no surprises. That means you can have a stage session open in one window and a clean production session in another without them interfering. FEATURES • Add any header — a name/value pair applied to outgoing requests from your targeted tabs. • Environment tags — label headers with tags like stage, prod, or dev. Clicking a tag activates every header carrying that tag and deactivates the ones from other environments, giving you a one-click prod to stage flip. Untagged headers are left alone. • Choose your target — "Inject Current Tab" applies headers to just the active tab. "Inject Window" applies them to every tab in the current window, including tabs you open later. • Paste to change value — refresh an expiring Authorization token straight from the clipboard in one click, without opening an editor. • Per-header on/off — keep headers in your list but disable them individually. • Inline editing — change a header's name, value, or tag in place. • Global Pause — a master kill switch that removes all injection rules instantly while preserving your headers and targets. Un-pause and everything comes back exactly as it was. • Autocomplete — common header names (Authorization, X-Request-Env, and others) and tags are suggested, and any name or tag you've used before is remembered. HOW IT WORKS HDrop uses Chrome's declarativeNetRequest API to write a single session rule scoped to your selected tab IDs. Header names are validated as proper HTTP tokens and values are checked for control characters, so a malformed entry is skipped rather than breaking your other headers. Closed tabs and windows are cleaned up automatically. PRIVACY HDrop does not collect, transmit, or sell any data. There are no analytics, no external servers, and no remote code. Your headers are stored locally in your own browser via chrome.storage.local and never leave your machine. Injection rules are session rules, so they do not persist across a full browser restart until you re-enable a tab or window — this is deliberate, so a forgotten header never silently follows you into a new browsing session.