Cross-Origin Proxy - CORS & API Environment Switcher

Your frontend talks to FAT, but the change you need to verify only exists on UAT. This extension lets you add one rule in Chrome instead of editing a dev-server proxy in every project, hardcoding a token, or asking the backend to open CORS and redeploy. Reach for it if any of these is familiar: - The console says blocked by CORS policy / Access-Control-Allow-Origin and you do not own the backend deployment - A localhost dev page needs to call an internal test environment - The API is not written yet, but the UI has to move forward - You need to exercise the timeout, HTTP 500 and offline fallback states without asking a backend engineer to reproduce them - You want another environment's auth token on the request without putting it in source control - Real-time features (WebSocket) have to follow the same environment switch - You want to hand a whole debugging setup to a teammate without describing it in chat What it does: - Match requests by wildcard, prefix or regular expression and forward them to another environment - Inject or replace request headers (such as the target environment's auth token) and replace request bodies - Send the target environment's cookies per rule, off by default: when a rule turns it on the extension issues the request with credentials: 'include', carrying the session you already have there instead of a cookie pasted into the header overrides - Response overrides: the status code, the response headers, or individual JSON fields by dot-notation path (`data.token`) - Mock responses with your own fake data (JSON / text / HTML / XML) when the API is not built yet - Conditional mock responses: give one rule several conditions (URL pattern, request method, query parameters) and the first match decides the body, status and Content-Type - Add 0–60000 ms of latency to throttle a slow network and exercise loading, skeleton and timeout states - Block requests to verify error handling and offline fallbacks; a blocked request is never replayed - Retry automatically on network errors, 5xx responses and the 30-second per-attempt timeout — off, or 1–5 attempts with a 100–30000 ms interval - Limit a rule to specific HTTP methods (GET/POST/PUT/DELETE/PATCH/OPTIONS/HEAD), or append and override query parameters on the proxied URL (gray-release tags, __env=uat) - Forward WebSocket connections, so real-time features follow the same environment switch - Rules that only rewrite a URL are resolved inside the browser's network layer (declarativeNetRequest), adding no script work to your page; turning the global switch off uninstalls those rules too, so no invisible redirect is left behind How a rule gets picked: - List order is priority — the lowest number matches first, and a request is handed to the first rule that matches it; the rules below are never evaluated - The URL match tester also lists the rules that match the same URL but sit behind it, so you can see the effect of a reorder before you make one - An empty target URL means "stay on this environment": the request is issued by the extension without changing its address, which is how you add a header or response override without redirecting anything Typical rules (swap the example hosts for your own): - Cross-environment switch: match https://fat-api.example.com/* → target https://uat-api.example.com - Use the other environment's credentials: add a request header override Authorization: Bearer <your UAT token> to that rule - API not ready yet: enable Mock with status 200, Content-Type application/json, and your sample JSON as the body - Slow network: enable delay with 3000–8000 ms - Failure states: enable Block, or override the response status to 500 - Gray release / A-B branch: append the query parameter __env=uat on the proxied URL - Send only writes to the test backend: restrict the rule to POST / PUT / DELETE Who reaches for it: - Frontend work: the API belongs to someone else and the page still has to move — proxy to another environment, or mock the endpoint that is not finished - Full-stack work: a localhost dev server calling an internal test backend, without a dev-server proxy table to maintain in every project - QA and integration support: timeouts, HTTP 500, offline and slow-network paths reproduced from delay and block, with nobody on the backend having to cooperate - Multi-environment or gray-release work: tag the proxied URL with a query parameter, switch FAT / UAT / PROD with a named profile - Handing a setup over: JSON export, HAR-to-rules, paste-a-cURL-to-a-rule — your teammate imports the identical configuration Debugging and teamwork: - A request log with method, status, duration and the rule that matched; open any entry for request and response headers and text bodies (a binary response body is not stored), JSON auto-formatted - A URL match tester in the header bar: type any URL (optionally with a method) to see in real time which rule matches, what the rewritten URL is, which channel it takes, and which other rules match the same URL but lose to it - Copy any logged request as cURL, using its original URL; HAR 1.2 export, HAR import that generates rules from recorded traffic (those rules arrive disabled until you enable them), and cURL paste import - Drag to reorder rule priority, enable/disable/delete one at a time or in batch, search by name, pattern or target, and filter by status and match type - Batch-migrate target domains across rules with a per-rule change preview - Start from a quick template while the list is still empty (wildcard proxy, prefix match, auth header, header override), and undo a delete immediately — a mistaken removal does not mean retyping the rule - Save the whole rule set as a named environment profile and switch between FAT, UAT and PROD in one click - Export configuration as JSON; share mode is on by default, stripping Authorization / Cookie style request and response headers plus token-like query parameters (untick it for a verbatim backup). On import you replace the curr…