Browsers don’t let a page set some headers (Cookie, Host, Origin, Referer, Content-Length…); they are dropped silently.
Cookie
Host
Origin
Referer
Content-Length
This request has no body.
Sent as an Authorization header. Credentials are kept in this browser’s history and saved requests, with everything else.
Authorization
Enter a URL and press Send or CtrlEnter.
A browser shows a page only the response headers the server lists in Access-Control-Expose-Headers, plus a few basic ones. Set-Cookie is never shown.
Access-Control-Expose-Headers
Set-Cookie
Courier sends every request with your browser’s own fetch(), from your machine. Courier’s server only delivers this page: it never sees your requests, responses, tokens or history.
fetch()
That keeps your data private and lets you reach http://localhost on your own machine. It also means the usual browser rules apply:
http://localhost
courier.chocomarsh.com
Access-Control-Allow-Origin
http://
localhost
127.0.0.1
History, saved requests and the request you are editing are kept in this browser’s local storage. Use “Clear history” to remove them.