Header Relay

Capture HTTP response headers and relay fixed or captured headers to matching browser requests.

Header Relay helps developers verify browser-based HTTP request behavior when an API or web app depends on custom headers, gateway headers, session tokens, trace IDs, or environment-specific request metadata. Create a profile, choose target origins, configure fixed request headers, and list response headers to capture. When a matching response includes a configured captured header, Header Relay keeps that value in memory for the current browser session and uses Chrome declarativeNetRequest session rules to attach it to later matching requests. Main features: - Origin-scoped header relay for local, staging, internal, and test environments. - Fixed request headers for values that should always be attached. - Captured response headers for values such as session tokens, trace IDs, or gateway headers. - Excluded path glob patterns for assets or endpoints that should not receive relay-managed headers. - Excluded-path tester for checking glob matching rules before saving. - URL Probe to check whether a URL is matched, excluded, and which headers would be attached — works on unsaved drafts. - Full-page settings with section-based navigation for profiles, origins, headers, excluded paths, URL Probe, and audit logs. - Multiple profiles can stay enabled at once, while individual profiles can be deleted when no longer needed. - Comfortable and compact display modes shared by the popup and settings page. - iOS-style UI across popup and settings for a consistent, native feel. - Compact popup status view for active headers, captured values, session state, and DNR rule count. - Local audit logs with automatic retention; request URLs are never persisted. - Japanese and Korean localization. Privacy and security: - Header Relay does not send profile settings, audit logs, usage events, analytics identifiers, browsing data, or captured headers to the developer, analytics providers, or unrelated servers. Configured header values are attached only to matching Target Origins. - Captured values are kept only in in-memory session storage, cleared on browser restart, extension disable/reload/update, profile disable, rule changes, host-access revocation, or manual clear, and masked by default in the UI. - Sensitive header names show a warning. `Cookie` remains available for development workflows with an explicit browser-state warning; response-only and transport-owned headers are rejected. - Audit logs do not persist request URLs: URLs are processed in memory for origin matching only and discarded when the browser closes. - HTTP localhost access is included for the default local-development workflow. Every other host is requested only when you add its Target Origin and optional access can be revoked anytime from Chrome's extension settings. This extension is intended for developers and QA workflows. Do not use it to store production credentials unless that is acceptable for your local browser profile. Version 0.5.0 — added per-origin host permissions, session-only captured values, sensitive-header safeguards, removable profiles, compact display settings, and diagnostic-only audit logs.