Send a custom HTTP header to one certain host only
Is there a way (Firefox add-on or about:config setting) to send a custom HTTP header for requests to a certain host?
Example: Send the header Foobar: true if (and only if) I request a resource from the host foo.example.com.
Bonus points if the protocol can be specified, too (e.g. only send the header when requesting over HTTPS).
(see my question Use additional “password” in Referer to hide private site? on IT Security SE on why I’d like to do it)
What I found so far
- The question Browser extensions to automatically alter HTTP headers? is similar, but looking for any way how to accomplish this (e.g. with the help of local proxies) and also not necessarily for Firefox
- You can create custom headers with the add-on Modify Headers, but it doesn't allow me to restrict the hosts, so it will send the custom headers for all requests
- There are some add-ons that allow setting custom values for certain HTTP headers per-host:
-
RefControl for
Referer -
HeaderControlRevived for
User-Agent,RefererandAccept-Language
-
RefControl for
- Related questions:
- Setting HTTP Headers form a Firefox Extension
- Firefox addon setting custom http header
- Send custom Referer when accessing a specific site via HTTPS (and not HTTP)
Solution 1:
If you are not restricted with Firefox, you can use Google Chrome's extension Header Hacker.
It provides:
- custom request headers (you're able either add new headers or override existing ones)
- permanent headers for specified hosts (you're able either add new headers or override existing ones)
So that you can solve your problem with second feature.
I'm using the extension a lot and it works fine for me.
Solution 2:
The Firefox add-on, Header Tool, does what you are looking for: https://addons.mozilla.org/en-us/firefox/addon/header-tool/
I just tried it out to restrict my custom request header to localhost.
Solution 3:
Since the release of Firefox 57, I've found the plugin Modify Header Value does the trick.
Modify Header Value can add, modify or remove an HTTP-request-header for all requests on a desired website or url.