Debug files carry your login
When support asks for a HAR file, they're asking for a recording of everything your browser sent and received. That includes cookies that keep you signed in, authorization tokens, form data such as passwords, and every page's content. Anyone with the file could sign in as you until those sessions expire.
What it removes
- Cookies in requests and responses.
- Login and API headers such as Authorization, API keys, CSRF and session tokens.
- URL parameters you choose, with likely secrets (tokens, codes, signatures, emails) ticked for you.
- Request bodies (form posts, including passwords), and optionally all response bodies.
- Images, fonts and media to make the file much smaller, plus email and IP addresses.
Recent versions of Chrome offer a sanitised HAR export that leaves out cookies and authorization headers. This tool also covers other browsers, older exports and the rest of the list.
IP removal covers IPv4 and IPv6 in readable HAR values, including forwarding headers and bracketed or zone-qualified IPv6. It does not decode addresses hidden in base64, binary data or other encoded content. Local IPv4 addresses beginning with 0 or 127 are kept for debugging. Review the cleaned log before sharing it.
Questions
Before sharing a support log: remove cookies, login headers and request bodies, then check the remaining URLs and response text for account names or private messages. For a smaller text excerpt, use the personal info redactor.
Is the file uploaded?
No. It's cleaned in your browser.
Will support still be able to debug the problem?
Usually yes: timings, URLs, status codes and headers stay. If they need a specific response body, turn off "All response bodies" and keep only that.
I already sent an uncleaned HAR file.
Sign out of that site everywhere (or change your password) to end the sessions it contains.