Header Injector

Add, override or remove HTTP headers (Authorization, custom...) on hosts matching a regex.

Header Injector adds, overrides or removes HTTP headers on every request sent to the hosts you choose — perfect for hitting a staging API with a token, testing Basic auth, faking CORS headers, or stripping a header while debugging. HOW IT WORKS Each rule is a hostname regular expression plus a list of headers: • ^api\.staging\.example\.com$ → Authorization: Bearer … • (^|\.)preview\.example\.com$ → Authorization: Basic … (built-in username/password helper) • ^localhost$ → response header Access-Control-Allow-Origin: * FEATURES • Request and response headers, with Set / Append / Remove operations • Applies to everything: pages, fetch/XHR, scripts, images, iframes, websockets… • Hostname regex with live validation and a built-in URL tester • Safe matching: wildcards can never match outside the hostname, so a token is never sent to another site by accident • Basic auth helper: type a username and password, get the Authorization header • Sensitive values (tokens, keys, cookies) are masked in the UI • Popup: global on/off switch, per-rule toggles, rules matching the current site, one-click "rule for this site" • Rule ordering: the rule highest in the list wins when two rules set the same header • Import / export as JSON • Badge with the number of active rules, or "!" when a rule has an error PRIVACY Your rules stay in your browser (chrome.storage.local). No analytics, no tracking, no remote code, no network requests of its own. Headers are only sent to the hosts matching your rules. Built on Chrome's declarativeNetRequest API: Chrome itself rewrites the headers, with no request interception overhead. Open source (MIT): https://github.com/leozero/header-chrome-extension