Puppeteer request interception credential masking without exposing Authorization header

To mask the `Authorization` header without exposing it to the page's JavaScript context, you must perform the header modification within the Node.js environment during the `request` event interception. Since the interception handler runs in the Node.js process and not within the browser's execution context, the credentials remain inaccessible to the page's scripts unless you explicitly pass them back via `page.evaluate`.

Implementation Strategy

The most secure method is to intercept the request, clone the headers object, delete the sensitive key, and then resume the request using `request.continue(). This ensures the browser never sees the original credential for that specific network request.

await page.setRequestInterception(true);

page.on('request', async (request) => {
  const headers = request.headers();

  // Check for the authorization header before attempting modification
  if (headers['authorization']) {
    // Create a shallow copy to avoid mutating the original request object unexpectedly
    const maskedHeaders = { ...headers };
    
    // Strip the sensitive credential
    delete maskedHeaders['authorization'];
    
    // Continue the request with the modified headers set
    request.continue({ headers: maskedHeaders });
  } else {
    request.continue();
  }
});

Consistency: Headless vs. Headed Modes

The behavior of request interception is generally consistent between headless and headed modes because both utilize the same Chrome DevTools Protocol (CDP) implementation. However, Chrome may sometimes normalize header keys (e.g., lowercase `authorization`) depending on the version and specific request type. To ensure consistent masking, always perform header key checks in a case-insensitive manner within your interceptor logic.

Verification Steps

To verify that masking is working correctly and not leaking, follow these checks:

• Log Outbound Traffic: Use page.on('request', ...) to log the headers being sent to request.continue(). Ensure the authorization key is absent in the Node.js console logs.
• Inspect Page Context: Attempt to access the headers via page.evaluate(() => window....) (if using a custom proxy script). If the masking is successful, the page should have no reference to the intercepted headers.
• Network Tab: Run the browser in headed mode and inspect the Chrome DevTools Network tab to verify that the actual outgoing request sent by the browser does not contain the header.

Assumptions: This solution assumes you are using Puppeteer v19+. If you are using a significantly older version, the request.continue syntax may vary slightly, but the logic of header manipulation remains identical.