5

A big web service asked me to upload a .HAR file from Chrome incognito to help them with my support request.

What sensitive information could I expose and how can I remove it?

I don't mind IP address and username, but stuff like:

  • Google authentication token
  • Google password (!!!)
  • Cookies or stored data from other websites
  • Any contents of my file system or other running apps

I tried doing a text search of the file and didn't see my password but could it be encrypted somehow that they could use it...

1 Answer 1

6

That depends entirely on the nature of the requests.

If you look at a .har file in a text editor, you will see that it's just a JSON document, containing your request and the associated response. It includes the following, potentially sensitive content:

  • Request Headers
  • Response Headers
  • Cookies
  • Request Content
  • Response Content

All of these could include session tokens or authentication credentials. Depending on the nature of the request, that could be benign, or be a compromise of your security.

For example, if you asked the tech support of an online shop with an issue related to your account, and the .har file would include a session token for said online shop, the potential damage would be minimal. In fact, it's very likely that they will need your session tokens to replicate the issue.

However, if the tech support would ask for a .har file including requests to third parties, then that may leak sensitive information.

What should I do now?

First of all, minimize the content of the .har file as much as possible. If they want a specific request, then capture only that request and nothing else.

Secondly, strip as much information from it as possible. It may be possible to replace your session token with a placeholder value, if all they need is to see the request that caused a particular behavior.

Finally, search through the entire archive for any and all data that may be sensitive. This is where the "minimize the size" step comes in handy.

If that sounds excessive - well, that's because it is. But you have to judge for yourself how much risk you're willing to take.

2
  • Thanks. So if I use Google login will they have my Google token, or only the token to their own site?
    – Richard
    Nov 18, 2021 at 20:14
  • 2
    @Richard I don't know for sure, but it would make sense only the token that would authenticate you for their site - otherwise anyone could log into your google account via by implementing a "Login with Google" function.
    – user163495
    Nov 18, 2021 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .