Request header rules

Send a header on every request to a host, such as a staging token, a feature flag or a debug user, and see it on the request that was actually sent, without a proxy and without touching the page.

Add a rule

1. Click Headers in the tracker's toolbar.
2. In the empty row at the bottom, type the header name (such as x-debug-user) under Header, its value under Value, and part of the URL it is for (such as api.example.com) in the box that reads All requests.
3. Click Add. The rule is in force at once and the Headers count goes up by one.
4. Reload the page, open a matching request, and find the header on its Headers tab with the note "Matches one of your header rules".

The browser applies the rule itself, so the request in the table is the one that went out. The name comes back in lowercase, which is how the browser reports a header a rule set, and a masked header stays masked: a rule you wrote is not a reason to uncover a token.

Think twice before leaving the filter empty. A rule with no filter sends its header to every site you load while the tracker is open. For a token, that means your credential. Name the host.

What a rule does

Part	What it takes
Header	A header name: letters, digits and - _ . ^ ~ and similar; no spaces, colons or accented letters. Case does not matter
Value	Any printable ASCII text, sent exactly as typed, spaces included. An empty value sends the header empty
URL filter	Part of the request URL, matched as a case-insensitive substring like every pattern list (Patterns). Empty means every request

• A rule sets the header: it adds it, or replaces the value the page would have sent.
• It applies to every kind of request: the page itself, frames, fetch and XHR calls, scripts, images, WebSockets and the rest, from every tab. Never to Loupewire's own requests.
• It applies to every tab even when the capture scope under Tabs records only one; a request outside the scope still carries the header, it just has no row.
• New rules start ticked. The Headers count shows the rules that are ticked, not all of them.

Edit, pause and remove

• Edit a rule by changing its header, value or filter in place, then press Enter or click elsewhere. The same checks run as for a new rule, and the tick is kept.
• Pause a rule by unticking it: it stays in the list and the next matching request goes out without the header. Tick it to resume.
• Remove a rule with its × button.

The "Matches one of your header rules" note compares a header with the rules ticked now. Untick a rule and the note leaves rows already captured; a header the page sent itself under the same name is noted too. Rows from an imported HAR never carry it.

Headers that get a warning

Nothing is refused by name. Host, Connection, Content-Length, Transfer-Encoding, Keep-Alive, Upgrade, TE, Trailer and anything starting with Proxy- or Sec- are part of how the connection works, so their rule is accepted with an alert triangle beside the stored rule: "This header is part of how the connection itself works. Editing it may break the request rather than change it."

What the panel refuses

You type	The panel says
No header name	Type a header name.
A name with spaces, a colon or accents	A header name can use letters, digits and - _ . ^ ~ and similar - no spaces, colons or accented letters.
A value with accents or control characters	A header value must be plain ASCII: it goes on the wire exactly as you type it.
*, ^ or | in the URL filter	* ^ and | have a special meaning in a URL filter, so this rule would apply to more requests than you described.
Accented text in the URL filter	A URL filter must be ASCII. The browser encodes a URL before matching it, so type the encoded form.
A second rule for the same header and filter	Another rule already sets the header for the same requests.

The header name is compared without case and the filter exactly as typed, so API.example.com and api.example.com count as two filters.

When rules are in force

• Rules are kept in the browser's local extension storage, so they are there again the next time you open the tracker. They act only while a tracker is open, window or tab.
• Moving the tracker between a window and a tab with the header switch keeps them in force.
• Pause stops recording, not rules: a paused tracker still sets your headers.
• Turning the extension off in Settings (Extension enabled) stops them.
• A site Loupewire cannot access gets no header and no row. When Site access is limited, the tracker's banner says that your header rules do not apply to the other tabs; Allow on all sites in that banner gives access back.
• If the browser refuses the rules, the panel says "Your header rules are not in force." and the Headers button is marked.

Common mistakes

• The header is missing from a request. Check the filter against the full URL, scheme included: example.com/api does not match https://api.example.com/.
• Two rules for one header on overlapping URLs. Which value wins is not defined. Give them filters that do not overlap.
• Looking for response headers. This panel sets request headers only.

Not in this version

Rules always set a header, creating or overwriting it. Appending to a value, removing a header, matching by regular expression or HTTP method, and response header rules are not in this version.