About DevHeader and its security model

DevHeader is a small Chrome and Edge extension for modifying HTTP request and response headers, redirecting URLs, and mocking API responses during web development. It was built as a minimal alternative to ModHeader.

Who maintains it

DevHeader is built and maintained by its developer. Bugs and feature requests go through the contact page. If it saves you time, you can buy me a coffee.

Threat model

• No broad host access. Sites are granted one at a time at runtime through optional_host_permissions.
• No network calls of its own. The extension does not phone home, use analytics, or upload your rules.
• No remote code. Everything is bundled locally, with no eval and nothing fetched dynamically.
• Local storage only. Configuration lives in chrome.storage.local on your machine.

Permissions and why

• storage, unlimitedStorage: Save profiles, rules, and mock responses locally. unlimitedStorage lifts Chrome's default 10MB cap for large mock bodies.
• declarativeNetRequest: Apply header and redirect rules using Chrome's declarative API, not the blocking webRequest API.
• permissions + optional_host_permissions: Ask for access to a site at runtime, only when you add it. There is no install-time <all_urls> grant.
• scripting, userScripts: Inject the page-context script that intercepts fetch/XHR for Mock Rules. Needs Chrome 138+ and the Allow User Scripts toggle.

Mock Rules are not narrowed by the Domains list. Once host permission is granted, a mock runs on any site whose request matches its URL pattern. See the Mocks docs for details.

Check it yourself

Read the privacy policy, and review the permissions Chrome shows in the store listing and on chrome://extensions. You can also watch the extension's network activity in Chrome's task manager and DevTools.