API header cleaner

Under the Hood: The Architecture of API Token Header & Cookie Cleaner

Incident tickets, GitHub issues, and Slack threads are where live credentials go to die. Engineers paste curl, Charles/Fiddler dumps, and HAR excerpts that still contain Authorization, Cookie, and access_token query params. A service that offers to clean API headers on a server is a paradox: you upload the leak to prevent the leak. Sanitize browser cookies and tokens in-process instead.

This page is a pure function of a string. Native APIs: RegExp, URL, URLSearchParams, optional Clipboard write, and Blob download. It does not instantiate Headers/Request against a network; those interfaces are documentation-level cousins. No dump is persisted.

Memory Allocation & Browser Threading Mechanics

useMemo maps lines on each keystroke. Cost is linear in dump length. Each absolute URL allocates a URL object; malformed tokens are caught and the original substring kept so one bad character does not destroy the rest of a curl line. Main thread is fine for support-sized pastes (tens of KB). A 50 MB HAR should be filtered elsewhere first; this tool is for headers, not full HAR replay.

Algorithmic Deep-Dive: Code Snippet & Logical Analysis

const SECRET = /^(authorization|proxy-authorization|cookie|set-cookie|x-api-key|x-auth-token|x-access-token|api-key)\s*:/i;

function cleanHeaders(raw) {
  return raw.split(/\r?\n/).map((line) => {
    if (SECRET.test(line)) return line.split(":")[0] + ": [REDACTED]";
    return line
      .replace(/https?:\/\/[^\s'"]+/gi, (url) => {
        try {
          const u = new URL(url);
          for (const key of [...u.searchParams.keys()]) {
            if (/token|key|secret|auth|password|session/i.test(key)) {
              u.searchParams.set(key, "[REDACTED]");
            }
          }
          return u.toString();
        } catch { return url; }
      })
      .replace(/\b(Bearer|Basic)\s+\S+/gi, "$1 [REDACTED]");
  }).join("\n");
}

Header-name redaction preserves the field so the dump remains a valid narrative (“yes, they sent Cookie”). Values become [REDACTED]. Inline Bearer/Basic on non-header lines (curl -H) are caught by the second replace. Query scrubbing is name-heuristic: token, key, secret, auth, password, session. False positives on keyboard= are possible; false negatives on t=eyJ are also possible—review the output before sharing.

The Local Storage Sandbox & Volatile Data Pipelines

Two strings in React state: dirty and clean. Copy uses navigator.clipboard.writeText on the clean string. Download wraps it in a text/plain Blob and revokes the object URL. There is no “recent dumps” drawer. Navigation drops both strings; GC reclaims them. Do not screenshot the input pane.

Verifying True Privacy: How to Audit Your Browser's Network Tab

F12 → Network → clear. Paste Authorization: Bearer eyJhbGciOiTEST and a Cookie: session=supersecret line. Copy sanitized. Search the HAR for eyJhbGciOiTEST and supersecret. Zero payload hits is a pass. That is the only honest test for an API header cleaner.