Remove cookies with HAR Desk
This opens a made-up login capture with a session cookie in the Cookie header, in the cookie list and in Set-Cookie. The cookie option is in focus: every value is replaced, the names and attributes stay.
- Load your HAR and open Sanitize.
- In the Cookies box choose: every cookie value, only sensitive-looking names, or none.
- Add a cookie rule for any name the list would not catch.
- Press Sanitize and check the cookie rows in the change list: the same cookie value has the same placeholder in every place it appears.
What to know
A HAR stores cookies three times: the Cookie request header, the cookies array of each request and response, and the Set-Cookie response header. A tool that only touches one leaves the others behind. HAR Desk applies the same cookie rule to all three, so a session id replaced in the header is also replaced in the arrays and in Set-Cookie, with the same placeholder.
Replacing every value is the safe default, because cookie names rarely tell you whether a value is sensitive: theme can hold a preference and sid a session. Choosing sensitive-looking names only keeps harmless preference cookies readable, matching names such as session, token, auth, jwt, csrf or key; any cookie rule you add always applies, whatever the option.
Cookie names, paths, domains, expiry and flags such as HttpOnly, Secure and SameSite stay, because they usually help diagnose a problem. Cookie names are visible to whoever receives the file. Values inside other headers (a session id in a custom header or URL) are covered only if a header, parameter or pattern rule matches them.
Updated · Cosmovex
Questions
Which cookie places are covered?
The Cookie request header, the cookies arrays on requests and responses, and the Set-Cookie response header, including several Set-Cookie lines in one header.
Are cookie names removed?
No. Names, domains, paths, expiry and flags stay so the cookie is still understandable. Only values are replaced.
Can I keep harmless cookies readable?
Yes. Choose the sensitive-looking names option, and add a cookie rule for any other name you want replaced.
What if a session id also appears in a URL or body?
Parameters named session, sid, token and similar are replaced by name, and the detectors catch token-like values. A value in an unusual field may be missed, so read the limitations and the changed fields.
The free plan covers everything on this page. HAR Desk Pro ($29, paid once) is described on the HAR Desk page.
