Redact JSON fields with HAR Desk
This opens a made-up checkout whose payment and cart bodies hold an email, a name and a card. Two JSON path rules are added for you, $.customer.email and $.billing.name; the built-in key rules for password, token and secret apply as well.
- Load your HAR and open Sanitize with bodies kept.
- Add JSON path rules under Your rules, for example $.customer.email, $.items[*].note or $..ssn.
- Press Sanitize and filter the change list by json-path to see each field replaced.
- Check the limitations for bodies that were not valid JSON, then download the sanitized HAR.
What to know
JSON path rules select values by position: $.a.b follows keys, $.a[0].b picks an array index, $.a[*].b every item of an array, $.a.* every child, and $..name any key called name at any depth. Key matching ignores case and * is a wildcard inside a name. The selected value, whether a string, number or whole object, is replaced by a placeholder string.
Built-in rules already cover keys named password, passwd, secret, token, api key, authorization, private key, ssn, cvv, cvc, card number and otp at any depth, and after the path rules every string left in the body is scanned for tokens, emails, card-like numbers and long secrets. Bodies stored as base64 are decoded first and re-encoded after.
Limits worth knowing: a body labelled JSON that is not valid JSON gets only the pattern detectors; when a body changes it is written back with standard JSON formatting, so spacing and very large integers may differ from the original; and the tool does not know what a field means, so a field you did not name and that does not look like a secret is kept.
Updated · Cosmovex
Questions
Which JSON path syntax is supported?
$.a.b, $.a[0].b, $.a[*].b, $.a.*, $['key with spaces'] and $..name for recursive descent. Filters and slices are not supported.
What happens to a non-string value?
Numbers, booleans, arrays and objects at a selected path are replaced by a placeholder string, because the original must not remain.
Are request bodies covered as well as responses?
Yes. Request post data and response content are both parsed when they are JSON, including base64-encoded bodies.
How many of my own rules can I add?
Three are free, and the built-in rules always apply. Pro removes the limit and lets you save the set as a policy.
The free plan covers everything on this page. HAR Desk Pro ($29, paid once) is described on the HAR Desk page.
