Courier Webflows Tab

Record and review browser workflows with Courier

Overview

The Webflows tab records browser interactions and related network traffic as reusable .courier workflows. Use it when an authorized test requires a repeatable sequence such as signing in, navigating to a feature, submitting a form, or reaching a specific application state.

Courier must be connected to Guard before a recording can start. An active Burp Proxy listener is also required because the recording browser routes traffic through Burp.

Start a Recording

  1. Connect Courier from the Control tab.

  2. Confirm that a Burp Proxy listener is running.

  3. Open Courier → Webflows.

  4. Click Record webflow.

  5. Complete the recording form:

    • Webflow Name — A descriptive name of at least three characters

    • Description — What the workflow does or the state it reaches

    • Project Name — The project associated with the recording

    • Start URL — The authorized HTTP or HTTPS URL where recording begins

  6. Click Start recording.

Record the Browser Workflow

Courier opens a browser at the start URL. Complete the workflow as a user would normally perform it.

Courier records supported actions including:

  • Navigation

  • Clicks

  • Text and form input

  • Form submissions

  • Dropdown selections

  • Checkbox and radio-button changes

  • Supported keypresses

Related browser requests and responses are captured and associated with the recording. When available, Courier also records browser video.

Close the page or browser when the workflow is complete. Courier then finalizes the recording, saves it locally as a .courier file, and attempts to synchronize it with Guard.

Review a Recorded Webflow

Select one webflow from the Recorded webflows list to review it.

The metadata area shows the webflow name, project, browser, and last-modified time. The recorded-steps table shows:

  • Step order

  • Action type

  • Description

  • Selector

  • Number of correlated requests

Hover over a selector's copy control to copy it for inspection or reuse.

Switch Between Pretty and JSON Views

Use the view selector above the recorded steps:

  • Pretty — Displays the workflow as a readable step table.

  • JSON — Displays a JSON preview of the recording. Large captured values may be shortened in the preview; the saved .courier file is not changed.

The JSON view can contain sensitive captured values. Review it carefully before copying or sharing it.

Manage the Webflow List

  • Right-click one or more selected webflows and choose Remove Selected to remove them from the displayed list.

  • Click Clear all to clear the displayed list after confirmation.

These controls clear entries from Courier's current displayed list. They do not delete .courier files that were already saved locally or objects already synchronized to Guard.

Credential and Session Data

Courier intentionally retains entered values so a recorded workflow can describe authenticated application state. A .courier file may therefore contain:

  • Usernames and passwords

  • API keys and session tokens

  • Cookies and authorization headers

  • Form values

  • Request and response bodies

  • Personal or customer data

Use dedicated testing accounts where possible. Store recordings securely, review them before sharing, and do not attach a recording to an unrelated project or target.

Troubleshooting

Recording does not start

  • Confirm that Courier is connected to Guard.

  • Confirm that at least one Burp Proxy listener is active.

  • Verify that the start URL begins with http:// or https://.

  • Confirm that Chrome or Chromium can be launched or installed.

  • Review the Control → Activity log for the reported error.

Expected steps are missing

  • Confirm that the action is one of the supported interaction types.

  • Wait for the application to finish loading before closing the browser.

  • Review Burp Proxy traffic to confirm that the recording browser is using the active listener.