Short answer: capture the HAR in Chrome or Edge DevTools with Preserve log on, open it in the HardcoreDebug HAR Analyzer (it stays in your browser), check the status codes, redirect chain and server IPs, then sanitize the file before attaching it to a Zscaler or Palo Alto support case.
Capture a HAR file the right way
- Open DevTools (F12) and go to the Network tab.
- Tick Preserve log and Disable cache.
- Reproduce the problem from the start, including the login if it's an authentication issue.
- Right-click the request list and choose Save all as HAR, or use the download (export) icon.
Newer Chrome versions export a sanitized HAR by default and offer a separate option to include sensitive data. Support teams sometimes need the cookies to debug authentication, so share the full file only when they ask, and sanitize it otherwise.
What to look for in Zscaler (ZIA) cases
- 403 responses or block pages: a URL filtering, cloud app control or file-type policy. The response body often names the policy or category.
- Redirects to authentication: if requests redirect to your Zscaler cloud's authentication or to your IdP and loop, the user's authentication cookie isn't being kept.
- Status 0 or failed requests: the connection never completed. This is common when SSL inspection breaks an app that pins certificates. Consider an SSL inspection bypass for that destination.
- Server IP: the analyzer shows the IP each request connected to. An address in Zscaler's published ranges (
config.zscaler.com) means the request went through the proxy. - Slow TTFB on every request: possible latency to the service edge. Check it with a Zscaler MTR test.
What to look for in Palo Alto cases
- GlobalProtect portal SAML login: follow the redirect chain from the portal to the IdP and back. A failed POST back to the portal's SAML endpoint, or a loop, points at IdP settings, certificates or clock skew.
- Prisma Access or firewall block pages: a response page instead of the site means URL filtering or a security policy matched. Note the URL and time for the traffic log.
- Captive portal redirects: unexpected redirects to an authentication portal on the firewall mean User-ID didn't map the user.
- TLS errors: decryption can break apps with pinned certificates. These show up as failed requests in the HAR.
Sanitize before sharing
Use Sanitize in the HAR Analyzer to strip cookies, authorization headers, tokens and form passwords. The cleaned file is saved straight to your computer and nothing is uploaded.
Frequently asked questions
How do I analyze a HAR file for a Zscaler issue?
Open it in a HAR analyzer and look for 403 or block-page responses, redirects to the Zscaler authentication or your IdP, failed requests (status 0) and the server IP each request connected to. Compare the server IPs with Zscaler's published ranges to see which requests went through Zscaler.
How do I check a Palo Alto GlobalProtect SAML problem with a HAR file?
Capture the login in the browser and follow the redirect chain between the portal and the identity provider. A loop or a failed POST back to the portal's SAML endpoint usually points at the IdP configuration, clock skew or a cookie that is not being sent.
Is it safe to send a HAR file to support?
Only after sanitizing it. HAR files can contain cookies, session tokens, passwords in form posts and page content. HardcoreDebug's HAR Analyzer has a Sanitize option that removes them in your browser before you share.
Does the HardcoreDebug HAR Analyzer upload my file?
No. The file is read and parsed entirely in your browser and is never sent to our server.