Edit headers on the way through
--header edits the headers the tunnel sends to your site. --response-header edits the headers your site sends back to the cloud browser. Both are repeatable, and neither needs a change to your application.
- Since v5.0
- Plain HTTP
Rule grammar
Each --header or --response-header takes one rule. Repeat the option for more.
| Rule | Effect |
|---|---|
| name: value | Set the header, replacing whatever the peer sent. |
| name; | Set the header to an empty value. |
| -name | Remove the header. |
| -name* | Remove every header whose name starts with name. |
Request headers
Headers sent from the tunnel to your site.
# tell the backend this traffic comes from automated tests
java -jar testingbot-tunnel.jar --header 'X-Test-Run: nightly-42'
# remove every X-Forwarded-* header before it reaches your server
java -jar testingbot-tunnel.jar --header '-X-Forwarded*'Response headers
Headers sent from your site back to the cloud browser. Useful for dropping a policy that blocks a test page without changing the server.
# a strict CSP blocks a test helper script
java -jar testingbot-tunnel.jar --response-header '-Content-Security-Policy'
# stop a staging site's HSTS from sticking in the browser
java -jar testingbot-tunnel.jar --response-header '-Strict-Transport-Security'
# allow the page to be framed by a test harness
java -jar testingbot-tunnel.jar --response-header '-X-Frame-Options'--extra-headers
--extra-headers adds request headers from a JSON object. It predates --header and still works.
java -jar testingbot-tunnel.jar --extra-headers '{"X-Environment":"staging","X-Tenant":"acme"}'For new setups, prefer --header: it can also replace and remove headers, and each rule is a separate option, which is easier to manage in a config file or CI variable.
HTTPS and headers
HTTPS arrives at the local tunnel as a CONNECT request and is relayed as opaque, encrypted bytes, so the local tunnel cannot see or change its headers. Header rules, --extra-headers and --auth apply to plain HTTP traffic.
If you need a header on an HTTPS site in a test, set it from the test itself, for example with your framework's request interception or a browser extension.
