When a debugging aid becomes a security hole
In October 2023, Cloudflare's Security Incident Response Team detected an attack that traced back to a stolen authentication token from an Okta support system. The intrusion succeeded because the attacker captured session tokens from HAR files that administrators had shared for troubleshooting. No customer data was compromised, but the incident highlighted a fundamental weakness in a widely used debugging format.
HAR (HTTP Archive) files are JSON-formatted records of a browser session. They capture every request and response exchanged between a browser and a web application, including headers, cookies, payloads, and timing data. For support teams debugging complex, layered web applications, HAR files are invaluable—they provide a complete, standardized snapshot of a user's interaction without requiring dozens of manual log-gathering steps.
That same completeness makes them dangerous. Session cookies, which keep users logged in across pages, live in browser memory and are normally never shared. HAR files offer a convenient way for that cookie to end up in the wrong hands. A stolen session cookie can grant unauthorized access to accounts, enable session hijacking, persist beyond the original session depending on cookie lifespan, and serve as a gateway for further attacks—especially if the compromised user has administrative privileges.
A sanitizer that strips before sharing
Cloudflare has released a HAR file sanitizer, available to everyone at no cost under an open source license. The tool accepts any HAR file and removes session-related cookies and JSON Web Tokens (JWTs) before the file is shared. It runs entirely on Cloudflare Workers, with all sanitization performed client-side, so Cloudflare never sees the full contents of session tokens.
The default behavior is to strip all session-related data. For cases where some session context is needed for troubleshooting, the tool supports conditional sanitization that removes only what's necessary to make the file safe.
Cloudflare Access is the first product the sanitizer has been tuned for. Access relies on JWTs—compact tokens used for secure authentication—to verify user permissions. The sanitizer removes the cryptographic signature from Access JWTs, leaving them inert while preserving enough detail for internal admins and support engineers to diagnose issues. Since HAR files contain a wide variety of data types, this selective approach isn't one-size-fits-all; Cloudflare plans to extend support to other authentication tools over time.
Additional protections on the roadmap
Beyond the sanitizer, Cloudflare intends to introduce several security controls within Zero Trust to reduce risks from stolen session tokens:
- Enhanced Data Loss Prevention (DLP) file type scanning to detect HAR files and session tokens, preventing users from sharing unsanitized files.
- Expanded API CASB scanning to find HAR files containing session tokens in tools like Zendesk, Jira, Drive, and O365.
- Automated sanitization of HAR files found in collaboration tools.
