How to modify HTTP request and response headers in Chrome and Firefox
Four ways to add, change or remove HTTP headers in the browser, depending on whether you need it once or on every page load.
| Method | Request headers | Response headers | Applies to |
|---|---|---|---|
| 1. Chrome DevTools | User-Agent only | Yes (overrides) | Every load while DevTools is open |
| 2. Firefox Edit and Resend | Yes | No | One request you resend |
| 3. curl | Yes | n/a | One request outside the browser |
| 4. Header-editor extension | Yes | Yes | Every matching request, DevTools closed |
1. Chrome or Edge DevTools
Response headers: open DevTools (F12) → Network, reload, right-click a request → Override headers. The first time, Chrome asks for a local folder to store overrides and for permission to use it. Add or edit headers in the Response Headers section; they apply on later loads as long as DevTools stays open and overrides are enabled. Useful for trying a Content-Security-Policy or CORS header before deploying it.
Request headers: DevTools can only change the User-Agent (⋮ → More tools → Network conditions → untick "Use browser default"). For Authorization, Origin, cookies or custom X- headers, use one of the methods below.
2. Firefox: Edit and Resend
DevTools → Network, right-click a request → Edit and Resend. Change the method, URL, headers or body and send it again; the new response shows up in the list. It applies to that one request, not to the page's later requests.
3. curl, for one-off tests
Right-click a request in the Network panel → Copy → Copy as cURL, then add or change -H options in a terminal:
curl 'https://api.example.com/me' -H 'Authorization: Bearer TOKEN' -H 'X-Debug: 1' -i-i prints the response headers. To turn the command into JavaScript or Python, paste it into the free curl to fetch / Python converter.
4. A header-editor extension (every request, DevTools closed)
When a header has to be on every request the page makes (an auth token for a staging API, a feature-flag header, a CORS or CSP change while you develop), use an extension. Well-known ones are ModHeader and Requestly. PlainHeaders is ours: free, no header limit, request and response headers, profiles, a "this tab only" lock and ModHeader import. It asks for access per site, when you click "Enable on this site", instead of all sites at install.
Chrome extensions change headers through Chrome's declarativeNetRequest API, so any of them may be unable to change a few headers that Chrome manages itself. If a change doesn't seem to apply, check the request in DevTools → Network → Headers.
More on specific headers: Referer, User-Agent and X-Forwarded-For (what changes and what doesn't), the Bearer token Authorization header, allowing several origins in CORS.
Frequently asked questions
Can Chrome DevTools change request headers?
Only the User-Agent, via Network conditions. Response headers can be overridden (right-click a request → Override headers). For other request headers use Firefox's Edit and Resend, curl or an extension.
How do I test a CORS fix without changing the server?
Override the response header Access-Control-Allow-Origin in Chrome DevTools or with a header extension. Remember this only changes your browser: real users still get the server's headers, so fix the server afterwards.
Is it safe to put an Authorization token in an extension?
It is stored in your browser profile like any extension setting. Use test or short-lived tokens, and remove the header (or pause the extension) when you're done.
Does changing headers work in Safari?
We have not tested a Safari method. Use curl, or Chrome or Firefox for header testing.
Written with AI assistance. PlainHeaders is our extension; the other methods are free.