HAR File - Share a Redirect Chain in DevTools Format

## Why it matters

HAR is how every tool shares network captures. Attach one to a ticket and the person on the other end opens it in whatever tool they already use: Chrome DevTools, Firefox, Fiddler, or a dedicated HAR viewer. No reproduction needed. They see the exact chain you saw, with every header and timing preserved.

It's also evidence. A HAR from today compared with a HAR after your fix proves the chain got shorter, the hops are faster, and the final status changed. A sceptical stakeholder can open both and verify the improvement themselves. That's the power of a portable format.

## How it works

A HAR file is JSON. At the top level it holds a log object. Inside that, log.entries is an array, one entry per HTTP request and response. Each entry records the URL, the method (GET, HEAD, etc.), the request headers, the response status, response headers, timings for DNS lookup, TCP connection, TLS, wait-time, and download, and the response body size.

Scalpel Redirects records each hop in the chain as one HAR entry. The final HAR has:

• One entry per hop (a 301, a 302, a final 200)
• The URL of each hop
• The status code
• Response headers (including Set-Cookie, Cache-Control, Strict-Transport-Security)
• Timing information for each leg

What's not in the HAR:

• Request bodies (Scalpel observed only responses, not what was sent)
• Request headers (same reason; the browser sent them but the tool only captured responses)
• Cookies (by design: a HAR can hold sensitive session tokens, so Scalpel never captures them)

## What does not matter

You don't need to understand the HAR JSON format to use it. Chrome DevTools imports it and shows the chain in the Network tab, exactly as if you'd recorded it there. The format is a transport layer; the tool on the other end handles it.

A HAR is also not a security log. It's a network trace, so it holds URLs and headers. Treat it with the same care you'd give a DevTools recording or a curl transcript before you paste it into a public ticket. Strip the URL paths if they're sensitive, or keep it in a private gist.

## Code example

A minimal HAR entry:

{
  "log": {
    "version": "1.2",
    "creator": {
      "name": "Scalpel Redirects",
      "version": "0.2.0"
    },
    "entries": [
      {
        "startedDateTime": "2024-01-15T10:30:00.000Z",
        "request": {
          "method": "GET",
          "url": "http://example.com/old",
          "headers": []
        },
        "response": {
          "status": 301,
          "statusText": "Moved Permanently",
          "headers": [
            { "name": "Location", "value": "https://www.example.com/new" },
            { "name": "Cache-Control", "value": "max-age=3600" }
          ],
          "content": { "size": 0 }
        },
        "timings": {
          "wait": 45,
          "receive": 2
        }
      }
    ]
  }
}
Copy

Import this into Chrome DevTools by opening the Network tab, right-clicking, and selecting "Import HAR file". The tool will display the chain as if you'd captured it live.

## How Scalpel Redirects shows it

The export menu offers "Copy HAR" to copy the JSON to your clipboard, or "Download HAR" to save a .har file. Name the file something descriptive (example-com-chain-2024-01-15.har) and attach it to your ticket or share it with the team. Anyone can open it in DevTools or a HAR viewer and see the exact chain you captured, complete with headers and timings.