Skip to content

v1.1.0

Choose a tag to compare

View all tags
@Multivalence Multivalence released this 31 Jul 20:58
v1.1.0
e0d1342

[1.1.0] — 2026-07-31

Feature-parity release. Adds cookie editing, a Content-Security-Policy editor, URL redirects, and tab/window scoping. No new permissions were requested.

Added

Cookie editor

  • Edit individual cookies instead of hand-writing the whole header
  • Request cookies compose the Cookie header; response cookies become Set-Cookie
  • Full attribute control on response cookies: Path, Domain, Max-Age, SameSite, Secure, HttpOnly
  • Per-profile choice between merging with the browser's existing cookies and replacing them outright

Content-Security-Policy editor

  • Three modes: leave CSP alone, strip it entirely, or replace it with a policy you compose
  • Build a policy one directive at a time, with autocomplete for the standard directive names
  • Live preview of the exact header that will be sent
  • Toggle between enforcing and Report-Only

Redirects

  • Send matching requests somewhere else — useful for pointing a CDN asset at localhost
  • Match by substring or by regex, with \1 capture-group substitution in the target
  • Loop protection: a redirect that resolves to the request's own URL is skipped

Filtering

  • Tab and Window filters, each with a Use current button that fills in the id for you
  • Exclude URL containing and Exclude URL regex, to carve exceptions out of a match

Interface

  • Comments on header and redirect rows, as notes to yourself
  • Undo with Ctrl+Z or the toolbar arrow, up to 40 steps
  • Profile search, shown once you have more than five profiles
  • Autocomplete for common request headers, response headers, and CSP directives
  • A profile on/off switch in the profile menu
  • Six sections, each with its own accent colour

Changed

  • The badge and status bar now count rules rather than headers, so cookies and redirects are included in the total
  • Export format is now version 2. Files exported by 1.0.0 still import correctly
  • Chrome: profiles that filter by tab or window compile to session rules, because tabIds is only supported there. Everything else stays in dynamic rules and still survives a browser restart
  • Chrome: minimum_chrome_version raised from 108 to 111

Fixed

  • Chrome: the manifest declared a minimum of Chrome 108 while the interface actually required Chrome 111 for CSS color-mix(). On 108–110 the extension installed and worked, but the site-access banner rendered without its background colour
  • Firefox: the manifest now declares data_collection_permissions: { required: ["none"] }, which recent AMO validation requires. OpenModHeader collects and transmits nothing, so none is the accurate declaration

Known platform differences

Two behaviours differ between the builds, both because Chrome's declarativeNetRequest cannot read a request before deciding what to do with it, while Firefox's webRequest can:

  Chrome Firefox
Request cookie merge Appended, so a duplicate name is sent twice True merge; a same-name cookie is overwritten
Exclude URL filters Suppress every profile's rules for that request Scoped to the profile that defines them

On Chrome, use Replace all cookies instead of merge if a duplicate would confuse your server.

Tab ids do not survive a browser restart on either platform, so a tab-scoped profile needs its id re-captured with Use current afterwards.

Assets 4
Loading