HeaderSmith 🛠️

The zero-telemetry, Manifest V3 HTTP header modifier built for developers, QA engineers, and API testers.

---

Why HeaderSmith?

In July 2026, ModHeader (an extension with ~1.6M users) was removed from the Chrome Web Store after researchers discovered a dormant browsing-history collector embedded in its signed binaries. Many extensions built on the legacy Manifest V2 webRequest API intercept every outbound network packet inside JavaScript, giving extensions raw visibility into all web activity.

HeaderSmith was built to restore trust:

• 🛡️ Provably Cannot Spy: Powered strictly by Chrome's native Manifest V3 declarativeNetRequest (DNR) engine. The browser engine modifies headers in C++ core; extension JavaScript never sees or intercepts your request URLs, payloads, or session cookies.
• 🔒 Zero Telemetry: Zero analytics SDKs, zero remote servers, zero pingbacks. Verify anytime via Chrome DevTools Network Tab.
• 📦 100% Local: All profiles, test tokens, and rules are stored on-device in chrome.storage.local.
• ⚡ 1-Click ModHeader Migration: Import your exported ModHeader JSON files seamlessly.
• 🔓 Open Source: Fully transparent and auditable.

---

Features

• Named Profiles: Organize your header rules into isolated environments (e.g., Local API Testing, Staging Overrides, CORS Bypass).
• Request & Response Headers: Add, modify (set), append, or strip (remove) headers on both outgoing requests and incoming responses.
• Per-Site Scoping: Target rules to specific domains, wildcards (e.g., *httpbin.org*, *localhost*), or regular expressions.
• Toolbar Popup: Quick ON/OFF master toggle, profile switcher, and current tab inspector showing active matching rules.
• Live URL Rule Tester: Built-in sandbox to test any URL against your active profile and verify matches in real-time.
• ModHeader Import & Export: One-click import from ModHeader JSON files, plus native JSON backup and restore.

---

Installation (Developer Mode / Unpacked)

1. Clone or download this repository:

   git clone https://github.com/CKosick/headersmith.git

2. Open Chrome and navigate to chrome://extensions/.
3. Enable Developer mode toggle in the top-right corner.
4. Click Load unpacked and select the headersmith folder.
5. The HeaderSmith icon will appear in your extensions toolbar!

---

Acceptance Testing

1. Custom Request Header:
   • In HeaderSmith, ensure the default "HTTPBin Test & Demo" profile is active (has X-HeaderSmith-Test: Active on *httpbin.org*).
   • Navigate to https://httpbin.org/headers.
   • Verify X-HeaderSmith-Test: Active is present in the returned JSON.
2. Strip Response Header:
   • Inspect the response headers for Access-Control-Allow-Credentials in DevTools Network tab — verified stripped.
3. Switch Profiles / Toggle:
   • Turn off the master toggle in the popup or select an empty profile.
   • Reload the page; headers remain unmodified.
4. ModHeader Migration:
   • Go to Full Dashboard → ModHeader Migration.
   • Drop or paste your ModHeader JSON file. Rules will appear instantly.

---

Architecture & Permissions

Permission	Purpose
declarativeNetRequest	Modifies request and response headers declaratively via Chrome's native network core.
storage	Stores profiles and rule configurations locally on your machine.
tabs	Allows the toolbar popup to identify the active tab's domain to display matching rules.
<all_urls>	Required by Chrome DNR to apply header modifications to user-specified domains.

---

Privacy Policy

Read the full plain-language privacy policy online at https://ckosick.github.io/headersmith/privacy.html or in PRIVACY.md.

---

License

MIT © 2026 HeaderSmith Contributors. See LICENSE for details.