How to re-order HTTP headers?

Question

I was wondering if there was any way to re-order HTTP headers that are being sent by our browser, before getting sent back to the web server?

Since the order of the headers leaves some kind of "fingerprinting", see this post and this post, I was thinking about using MITMProxy (with Inline Scripting, I guess) to modify headers on-the-fly. Is this possible?

How would one achieve that?
Note: I'm looking for a method that could be scripted, not a method using a graphical tool like the Burp Suite (although Burp is known to be able to re-order headers)

I'm open to suggestions. Perhaps NGINX might come to the rescue as well?

EDIT: I should be more specific, by giving an example...

Let's say I'm using Firefox. With the use of a funky add-on, I'm spoofing my user-agent to "look" like a Chrome browser. But then if I test my browser with ip-check.info, the "signature" of my browser remains the one of Firefox, even though my spoofed user-agent shows "Chrome".

So the solution, in this specific case, should be to re-order the HTTP headers in the same manner as Chrome does.

How can this be done?

Answer 1

For the record, the order of the HTTP headers should not matter at all according to RFC 7230. But now that you have asked... this can be done in mitmproxy as follows:

import random

def request(context, flow):
    # flow.request.headers.fields is a tuple of (name, value) header tuples.
    h = list(flow.request.headers.fields)
    random.shuffle(h)
    flow.request.headers.fields = tuple(h)

See the mitmproxy documentation on netlib.http.Headers for more details.

There are tons of way to reorder them as you wish:

def reorder(headers, header_order=["Host","User-Agent","Accept"]):
    lines = []
    for name in header_order:  # add existing headers in the specified order
        if name in headers:
            lines.extend(headers.get_all(name))
            del headers[name]
    lines.extend(headers.fields)  # all other headers
    return lines
request.headers.fields = reorder(request.headers)