Amazon service just asked me to share a HAR file and I though for sure it was a security risk. Doesn’t that mean that agent has an authentication cookie to my account? Why can this be common with practice
Yes, modulo your session durations and, for services which implement it, IP fixation. You should treat HAR files as secrets for anything involving a login.
When I was talking to Amazon support they provided instructions on how to strip tokens together with the ask for a HAR file.