What changed, and who it hurts.
Manifest V3 removed blocking webRequest, leaving developers wondering how to modify response bodies. Here is why declarativeNetRequest cannot touch payloads and how modern interceptors bypass the limitation.
declarativeNetRequest (DNR) API handles headers, redirects, and blocking, but cannot read or modify response bodies by design.chrome.debugger CDP (triggers an annoying yellow banner), and MAIN-world fetch/XHR interception.fetch and XMLHttpRequest to provide full body mocks, recursive JSON deep merge, and latency injection without warnings.Under Chrome Manifest V2, developers used chrome.webRequest.onBeforeRequest and webRequestBlocking to synchronously intercept network streams and rewrite response payloads. To improve browser performance and security, Google deprecated blocking webRequest in Manifest V3, replacing it with declarativeNetRequest (DNR).
While declarativeNetRequest is fast and privacy-preserving, it has a major architectural constraint: the browser executes rules declaratively, meaning extension code never touches the raw response stream. DNR can block requests, redirect URLs, upgrade HTTP to HTTPS, and modify request/response headers. It cannot inspect, rewrite, or mock response bodies.
Chrome DevTools lets you right-click a network request and select Override content. Chrome saves a static file to your local disk and serves it on reload. While useful for quick CSS or HTML edits, it fails for dynamic APIs: it cannot change HTTP status codes (e.g. simulate a 500 or 429), cannot inject delays, cannot partially merge JSON, and cannot be shared across a team. See DevTools Local Overrides vs a proxy interceptor.
Extensions can attach to a browser tab using chrome.debugger and use Fetch.requestPaused to fulfill requests with custom response bodies. However, this triggers a persistent yellow warning bar across the top of the browser: *"ProxyCeptor started debugging this browser"*. This makes it unsuitable for daily developer workflows, automated QA, and screen recordings.
Because extensions cannot touch bodies in the service worker, modern interceptors inject a script into the page's MAIN execution world (via chrome.scripting.executeScript({ world: "MAIN" }) or registered content scripts). This script monkey-patches window.fetch and window.XMLHttpRequest directly in the web app's runtime context, catching requests before they reach application code and returning synthetic or modified responses.
| Tool / Extension | Modify Headers | Redirect URL | Modify Response Body | JSON Deep Merge | Delay / Latency | No Warning Banner | Team Sync |
|---|---|---|---|---|---|---|---|
| ProxyCeptor | Yes (DNR) | Yes (DNR) | Yes (MAIN Hook) | Yes (Recursive Merge) | Yes (0–60s) | Yes (Zero Banner) | Yes (Cloud Workspace) |
| Requestly | Yes (DNR) | Yes (DNR) | Yes (Page Hook) | Via custom script | Yes | Yes | Yes (Paid) |
| ModHeader | Yes (DNR) | Limited | No | No | No | Yes | Profiles Export |
| DevTools Local Overrides | Yes | No | Yes (File-based) | No (Full replace only) | No | Yes | No (Local disk only) |
| Postman Interceptor | No (Capture) | No | No | No | No | Yes | Via Postman |
Rather than choosing between declarative speed and response body flexibility, ProxyCeptor combines both into a unified engine with zero certificate installation:
localhost:3000), blocking tracking pixels, and injecting Authorization or CORS headers.window.fetch, XMLHttpRequest, and navigator.sendBeacon. When a matching request resolves, it can completely replace the payload (replace-whole), execute custom JavaScript transforms (execute-js), or apply Recursive JSON Deep Merge (`merge-json`).Here is the conceptual pattern used by modern interceptors to hook window.fetch inside the MAIN world without breaking standard web APIs:
Not through declarativeNetRequest alone. In Manifest V3, extensions must inject an interceptor into the page's MAIN execution world to hook window.fetch and XMLHttpRequest, or use the chrome.debugger API (which triggers a prominent browser warning banner). ProxyCeptor uses the MAIN-world injection approach for seamless, banner-free body mocking.
declarativeNetRequest (DNR) is a browser-level API that modifies requests (headers, redirects, blocking) before they hit the network, but cannot see or alter response bodies. Fetch interception operates inside the web application's JavaScript runtime, allowing full inspection and modification of JSON payloads, status codes, and response timing.
Use ProxyCeptor's Recursive JSON Deep Merge (merge-json) rule. It fetches the real response from your live API, deeply merges your delta patch into the response object, and delivers the combined result to the UI. This allows you to test edge cases while keeping the remaining 99% of live production data intact.
Yes. Chrome DevTools Network throttling throttles the entire browser connection. With an interceptor like ProxyCeptor, you can set a granular delay (e.g. 3,500ms) on a specific URL pattern while all other network calls run at full speed.
No jargon, no gatekeeping.
Local Overrides is Chrome's built-in way to fake a response. It is great for quick edits and awkward for everything else. Here is exactly where the line is.
Deep breath. Here we go.
It flashes for 40 milliseconds on my machine and I have declared victory. Deep breath. Let us talk about loading states.
Create a free ProxyCeptor account to mock, delay, block and rewrite API traffic, then share the same rules with your team.