Introducing Edgio’s Open-Source HAR Sanitizer Tool

Authors: Tom Gorup, Anthony Campolo, Andrew Johnson

Introduction

Following the widely reported Okta breach that impacted various providers, including Cloudflare, BeyondTrust, and 1Password, we felt it was necessary to contribute to the solution by providing accessibility to more methods for sanitizing HAR files. This tool is released under an open-source license, making it available indefinitely, ensuring its utility as long as HAR files are essential for support teams.

What is a HAR file?

If you’re unfamiliar with HAR files, short for HTTP Archive, they are a log of a web browser’s interactions with a website. Support teams use them to help diagnose customer experience issues. HAR files streamline a process that would otherwise be challenging and require a lot of manual effort to track down logs from different networks, devices and browsers. Widely used, a quick Google search finds about 18,700 results for support pages explaining how to create a HAR file. Every action the browser takes is captured and stored in a JSON-formatted HAR file, which captures information including complete request/response headers, content payloads, timing information (e.g. DNS lookups), and more. But as often happens in security, this convenience comes with a tradeoff. HAR files also contain very sensitive information including cookies and session tokens.

What Could an Attacker do with an Unsanitized HAR file?

The short answer is a lot! A few of the potential risks associated with unauthorized access to a HAR file include:

1. Session Hijacking: If the HAR file contains session tokens or sensitive cookies, a malicious actor could use this information to hijack a user’s session, gaining unauthorized access to their account.
2. Data Exposure: Personal information, passwords, or other sensitive data exchanged between the client and server may be exposed, providing valuable information for identity theft or other malicious activities.
3. Reconnaissance: The detailed information in a HAR file can be used for reconnaissance purposes, helping attackers understand the structure and vulnerabilities of a web application. This information may aid in planning more targeted attacks, XSS attacks or other forms for injection attacks.
4. Privacy Exposure: HAR files may capture a user’s browsing behavior, including visited URLs. In the wrong hands, this information could be used for privacy violations or targeted phishing attacks.

If a bad actor were able to get their hands on a HAR file generated by a website administrator or security personnel, they could potentially wreak havoc with your site or app. Through a successful session hijack, an attacker with admin privileges could turn down rate limiting to make a site more susceptible to DDoS attacks, modify bot management settings to block legitimate bots like Google’s and hurt SEO (and revenue), or even delete your website. There are many negative possibilities, but there are also steps you can take to lower your risk.

Introducing Edgio’s HAR Sanitizer