diff --git a/src/background/messages/prepareStream.ts b/src/background/messages/prepareStream.ts
index 6fb4fbe..f62327c 100644
--- a/src/background/messages/prepareStream.ts
+++ b/src/background/messages/prepareStream.ts
@@ -3,7 +3,7 @@ import type { PlasmoMessaging } from '@plasmohq/messaging';
 import type { BaseRequest } from '~types/request';
 import type { BaseResponse } from '~types/response';
 import { setDynamicRules } from '~utils/declarativeNetRequest';
-import { assertDomainWhitelist } from '~utils/storage';
+import { assertDomainWhitelist, modifiableResponseHeaders } from '~utils/storage';
 
 interface Request extends BaseRequest {
   ruleId: number;
@@ -18,6 +18,17 @@ const handler: PlasmoMessaging.MessageHandler<Request, BaseResponse> = async (re
     if (!req.sender?.tab?.url) throw new Error('No tab URL found in the request.');
     if (!req.body) throw new Error('No request body found in the request.');
 
+    // restrict what response headers can be modified
+    req.body.responseHeaders = Object.keys(req.body.responseHeaders ?? {})
+      .filter((key) => modifiableResponseHeaders.includes(key.toLowerCase()))
+      .reduce(
+        (obj, key) => {
+          obj[key] = (req.body?.responseHeaders ?? {})[key];
+          return obj;
+        },
+        {} as Record<string, string>,
+      );
+
     await assertDomainWhitelist(req.sender.tab.url);
     await setDynamicRules(req.body);
     res.send({
diff --git a/src/utils/declarativeNetRequest.ts b/src/utils/declarativeNetRequest.ts
index b58bd0a..88b7a6c 100644
--- a/src/utils/declarativeNetRequest.ts
+++ b/src/utils/declarativeNetRequest.ts
@@ -21,17 +21,6 @@ const mapHeadersToDeclarativeNetRequestHeaders = (
 };
 
 export const setDynamicRules = async (body: DynamicRule) => {
-  // restrict what response headers can be modified
-  body.responseHeaders = Object.keys(body.responseHeaders ?? {})
-    .filter((key) => modifiableResponseHeaders.includes(key.toLowerCase()))
-    .reduce(
-      (obj, key) => {
-        obj[key] = (body.responseHeaders ?? {})[key];
-        return obj;
-      },
-      {} as Record<string, string>,
-    );
-
   if (isChrome()) {
     await chrome.declarativeNetRequest.updateDynamicRules({
       removeRuleIds: [body.ruleId],