What is a HAR file? Capture, risks, and what an AI agent can do with one
A HAR is a JSON recording of every request a page made: headers, cookies, bodies, timings. How to export one in each browser, why support teams ask for them, and the token-theft caution.
A HAR (HTTP Archive) file is a JSON recording of every network request a browser tab made: URLs, headers, cookies, request and response bodies, and timings. You export one from your browser’s developer tools, usually to show a support team exactly what happened. Treat it like a password file: a HAR can contain live session tokens, which is how attackers hijacked real customer sessions in the 2023 Okta support breach. Modern Chrome and Edge export a “sanitized” HAR by default for exactly that reason.
What’s actually in one
The format (HAR 1.2, frozen) is a JSON document whose log.entries array holds one object per request: the request (method, URL, headers, cookies, posted data), the response (status, headers, cookies, body content), and a timing breakdown: DNS, connect, send, wait, receive. It was drafted for W3C standardization and never published (the draft literally carries an abandoned notice), but it won anyway: every major browser exports it, every serious HTTP tool imports it, and it’s the lingua franca of “show me what your browser did.”
Exporting one, per browser
- Chrome: DevTools → Network → the export button (or right-click a request → Copy → Save all as HAR). Since Chrome 130 the default export is sanitized: it strips
Cookie,Set-Cookie, andAuthorizationheaders; the with-sensitive-data variant must be enabled in DevTools settings first. - Edge: identical shape (“Export HAR (sanitized)” by default; a settings checkbox unlocks the sensitive version). Note Edge’s docs: the export contains everything since DevTools opened: you can’t save a single request.
- Firefox: Network Monitor → right-click → Save All As HAR (or the HAR dropdown in the toolbar).
- Safari: Web Inspector → Network tab → Export (⌘S).
Recording tip that saves a round-trip with support: open DevTools first, tick “preserve log,” reproduce the problem, then export. The file only contains what the panel saw.
The security part people learn the hard way
A HAR taken while you’re signed in contains the cookies and tokens that are your signed-in session, plus anything you typed into forms while recording. This stopped being theoretical in October 2023: attackers with access to Okta’s support system read HAR files customers had uploaded for troubleshooting, and per Okta’s own root-cause report the files “contained session tokens which could in turn be used for session hijacking attacks”: five customers had live sessions hijacked that way. The lessons are mechanical: export sanitized unless someone genuinely needs the headers, redact before sharing (Google’s HAR Analyzer can produce a redacted copy), and treat any HAR that ever held tokens as a credential, because sanitized-by-default only strips headers, not form data or tokens embedded in URLs and bodies.
What an AI agent can do with a HAR
Here’s the newer trick. An agent driving a browser for every interaction with a site is slow and fragile. But record a HAR while you perform the task once, hand the file to the agent, and it can read the actual API traffic behind the UI (endpoints, parameters, auth headers) and derive a small client that calls those endpoints directly from then on. One capture, and the agent mints its own integration for a service that never published an API. It’s a pattern working developers popularized in 2026 (dax’s uber-eats-cli demo being the famous one), and it inherits every caveat above (the HAR you hand an agent contains your live credentials, so it belongs on a machine you trust with them), plus the usual one: private APIs change without notice, and automating a service against its terms is on you, not the file format.