Modifying Request Headers

When your browser talks to a website, it sends messages called HTTP requests. These requests carry extra info, like metadata, in something called headers.

Headers tell the server things like what browser you're using (User-Agent), what kind of content you expect (Accept), or even authentication tokens (Authorization).

We learned about declarativeNetRequest for blocking and redirecting. It's powerful because it lets the browser handle rules efficiently, without your extension's JavaScript always running.

Today, we'll use it to modify these request headers, adding, changing, or removing them before a request even leaves your browser!

To change headers, we use a specific actionType within our declarativeNetRequest rules: "modifyHeaders".

This action takes an array of requestHeaders. Each item in this array describes a single header modification you want to make.

For each header modification, you specify an operation:

• "set": Replaces an existing header's value or adds it if it doesn't exist.
• "append": Adds a new value to a header. If the header already exists, it will have multiple values. If not, it adds it.
• "remove": Deletes a header entirely from the request.

To use declarativeNetRequest for header modification, your extension needs specific permissions in its manifest.json file:

• "declarativeNetRequest": The basic permission to use the API.
• "declarativeNetRequestWithHostAccess": Needed if your rules modify headers on specific websites (hosts). This is usually the case!

Let's add a custom header called X-CoddyKit-User to all outgoing requests. This could be useful for identifying requests from your extension.

This code goes into your extension's background.js file.

The code uses chrome.declarativeNetRequest.updateDynamicRules to manage rules. Here's a quick breakdown:

• id: A unique number for your rule.
• priority: Determines which rule wins if multiple rules apply.
• action: Defines what to do. Here, "modifyHeaders" with our requestHeaders.
• condition: Specifies when the rule applies (e.g., <all_urls> for everywhere).

You can use "set" to change standard headers too. Here, we'll modify the User-Agent header for requests going to example.com. This spoofs your browser's identity for that site.

Sometimes, you might want to remove a header for privacy or to prevent certain tracking. Let's remove the Referer header for all image requests.

The Referer header tells a website where you came from.

You want to add an API key as a custom header, X-API-Key, to a request. If the header somehow already exists, you want to make sure your key is also present, possibly as a second value, rather than replacing an existing one.

Great job! You've learned how to powerfully modify HTTP request headers using declarativeNetRequest.

• We explored the "modifyHeaders" action.
• Understood the "set", "append", and "remove" operations.
• Saw how to add custom headers, change user agents, and remove sensitive info.
• Remember the necessary permissions: declarativeNetRequest and declarativeNetRequestWithHostAccess.

Next, we'll dive into redirecting and rewriting URLs!