Modify Headers in HTTP(s) Requests and Responses
Tags: cors, modify, headers, modifyheaders
Published: 2022-08-18 10:58:03

---
title: Modify Headers in HTTP(s) Requests and Responses
published: true
date: 2022-08-13 19:56:14 UTC
tags: cors,modify,headers,modifyheaders
canonical_url: https://requestly.com/blog/modify-headers-in-https-requests-and-responses-in-chrome-firefox-safari/
---

[HTTP(s) Headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers) are key-value pairs that can be used by the client or server to pass additional information along with an HTTP(s) request or response.

Headers carry data about the data being transferred. The ability to modify the headers of traffic that pass through your browser easily is what every developer would want to have.

![](https://cdn-images-1.medium.com/max/1024/1*wAC8tovHOvp0vF4bSRl-3g.png)
_Modify headers using requestly_

[Requestly](https://requestly.com) can be used to modify request and response headers in simple clicks.

### To modify headers, select Modify Headers Rule.

![](https://cdn-images-1.medium.com/max/1024/0*iBoMFtZITe6bPFXg.png)
_Select modify headers from the rule selector_

### Select type of headers to modify- Request/Response

- A new header can be added.
- Existing header can be removed.
- Existing header’s value can be overridden.

![](https://cdn-images-1.medium.com/max/1024/0*Smht3s1MKOVUz8s9.png)
_Modify Headers rule editor_

### When modifying headers is helpful?

#### Open websites in iframe for testing

Sometimes you need to open pages in iframe, but response headers like [X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) and [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) does not allow it to prevent [clickjacking](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html). Using Requestly, you can modify this header to allow the website to be opened in iframe.

#### Remove [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)

Content-Security-Policy response header is added to the website to prevent injection of external scripts but sometimes while testing it is required to inject scripts. Requestly can be used to remove CSP response header.

#### Access Kubernetes dashboard by modifying [Authorization](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization) header

You can access dashboard, you simply need to pass Authorization: Bearer <token> in every request to Dashboard. Requestly enables you to quickly modify the header.

Find more information [here](https://github.com/kubernetes/dashboard/blob/790bc1ec5e22642f64e86903f626005a26573cbc/docs/user/access-control/README.md#:~:text=to%20display%20it.-,Authorization%20header,-Using%20authorization%20header).

#### Add custom request headers

Custom request headers can be added to manage features. Generally x-custom-header convention is followed.

#### Change Content-Type of the requested resource.

#### Test sites in production

To test sites in production, one can use local backend with the production site but here the browser can give [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) errors.

The following response headers can be modified using Requestly to test sites in production.

- Access-Control-Allow-Origin
- Access-Control-Allow-Methods
- Access-Control-Allow-Headers
- Access-Control-Allow-Credentials

Modifying headers happens to be a powerful tool in the hands of the developer. There’s a lot that can be done than covered in this article.

### Modify Headers in Safari

[Download the Requestly desktop app](https://requestly.com/downloads/) to modify headers in safari and other apps.


I hope you enjoyed learning about modifying headers. If you have any questions, feel free to ask them in our [community section](https://community.requestly.io/).

Here’s a demo video which shows modification of headers in action

{%embed https://www.youtube.com/embed/CLEHS6NFYZY %}

**Happy Debugging 🚀**

_Originally published at_ [_https://requestly.com._](https://requestly.com/blog/modify-headers-in-https-requests-and-responses-in-chrome-firefox-safari/)