Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code

github.com

Post reply on HN
Print view View original

21–30 of 62 posts

Re: Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code

#21

Post by ricardo81 »

bityard wrote: post #20
ricardo81 wrote: post #16

Earlier quoted context omitted.

I'm still not understanding. If you're coding something up, why wouldn't you know that piece of code does a HTTP/s request? Based on what you said, it sounds like a scenario where a programmer doesn't know how a request was made. Are there examples of scenarios where that's the case? Sounds like a bit of a security nightmare where there's code doing arbitrary requests.

Maybe you are working with an application or library that you didn't write, and want to see the raw requests and responses it generates without reading the entirety of the source code. Maybe you are generating HTTP requests through an API and need to see which headers it sets by default, or which headers are or are not getting set due to a misconfiguration or bug. There are probably loads more use cases, and if I act…

The 3rd party library stuff makes sense, to an extent. But then you're debugging a 3rd party library.

Re: Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code

#22

Post by golergka »

ricardo81 wrote: post #16
cle-b wrote: post #15

Earlier quoted context omitted.

Unlike other tools such as proxies that allow you to trace HTTP requests, httpdbg makes it possible to link the HTTP request to the Python code that initiated it. This is why it is specific to Python and does not work with other languages.

I'm still not understanding. If you're coding something up, why wouldn't you know that piece of code does a HTTP/s request? Based on what you said, it sounds like a scenario where a programmer doesn't know how a request was made. Are there examples of scenarios where that's the case? Sounds like a bit of a security nightmare where there's code doing arbitrary requests.

> If you're coding something up, why wouldn't you know that piece of code does a HTTP/s request?

Because tracing all side-effects in a huge codebase with a lot of libraries and layers can be a daunting task.

Update: if you haven't worked with 20 year old >1m LOC codebase which went through many different teams and doesn't have any documentation whatsoever, you may lack necessary perspective to see value tools like this.

Re: Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code

#23

Post by whirlwin »

ricardo81 wrote: post #16
cle-b wrote: post #15

Earlier quoted context omitted.

Unlike other tools such as proxies that allow you to trace HTTP requests, httpdbg makes it possible to link the HTTP request to the Python code that initiated it. This is why it is specific to Python and does not work with other languages.

I'm still not understanding. If you're coding something up, why wouldn't you know that piece of code does a HTTP/s request? Based on what you said, it sounds like a scenario where a programmer doesn't know how a request was made. Are there examples of scenarios where that's the case? Sounds like a bit of a security nightmare where there's code doing arbitrary requests.

Here's a concrete scenario for you: Say you are in a team of 10 developers with a huge codebase that has accumulated over 5+ years. If you're new in the team, and you need to understand when a specific HTTP header is sent, or just snoop the value in the payload you otherwise wouldn't be able to see.

Re: Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code

#24

Post by diegoallen »

ricardo81 wrote: post #21
bityard wrote: post #20

Earlier quoted context omitted.

Maybe you are working with an application or library that you didn't write, and want to see the raw requests and responses it generates without reading the entirety of the source code. Maybe you are generating HTTP requests through an API and need to see which headers it sets by default, or which headers are or are not getting set due to a misconfiguration or bug. There are probably loads more use cases, and if I act…

The 3rd party library stuff makes sense, to an extent. But then you're debugging a 3rd party library.

If a 3rd party library you depend on has bugs, you have bugs. And you need to either submit a patch to the library or find a workaround.

Re: Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code

#25

Post by ricardo81 »

golergka wrote: post #22
ricardo81 wrote: post #16

Earlier quoted context omitted.

I'm still not understanding. If you're coding something up, why wouldn't you know that piece of code does a HTTP/s request? Based on what you said, it sounds like a scenario where a programmer doesn't know how a request was made. Are there examples of scenarios where that's the case? Sounds like a bit of a security nightmare where there's code doing arbitrary requests.

> If you're coding something up, why wouldn't you know that piece of code does a HTTP/s request? Because tracing all side-effects in a huge codebase with a lot of libraries and layers can be a daunting task. Update: if you haven't worked with 20 year old >1m LOC codebase which went through many different teams and doesn't have any documentation whatsoever, you may lack necessary perspective to see value tools like th…

Sounds like people dealing with code they have no idea what it does. No amount of tools are going to help with that.

Re: Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code

#26

Post by ricardo81 »

whirlwin wrote: post #23
ricardo81 wrote: post #16

Earlier quoted context omitted.

I'm still not understanding. If you're coding something up, why wouldn't you know that piece of code does a HTTP/s request? Based on what you said, it sounds like a scenario where a programmer doesn't know how a request was made. Are there examples of scenarios where that's the case? Sounds like a bit of a security nightmare where there's code doing arbitrary requests.

Here's a concrete scenario for you: Say you are in a team of 10 developers with a huge codebase that has accumulated over 5+ years. If you're new in the team, and you need to understand when a specific HTTP header is sent, or just snoop the value in the payload you otherwise wouldn't be able to see.

Snooping traffic isn't new though, so what's specific about this tool and Python.

Re: Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code

#27

Post by diegoallen »

stuaxo wrote: post #7

This is great - It would be good to be be able to have django debug toolbar integration, that way I could see which requests were made to backend APIs without leaving Django. Having tried MITMProxy something like httpdbg is definitely needed.

You can do that with django debug toolbar. If you have an endpoint that doesn't return HTML, and hence wouldn't render debug toolbar, you can go to django admin (or any other endpoint that would render ddt) and go to the history pane, check other requests and switch to them.

Re: Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code

#28

Post by ricardo81 »

diegoallen wrote: post #24
ricardo81 wrote: post #21

Earlier quoted context omitted.

The 3rd party library stuff makes sense, to an extent. But then you're debugging a 3rd party library.

If a 3rd party library you depend on has bugs, you have bugs. And you need to either submit a patch to the library or find a workaround.

Or just not use arbitrary 3rd party stuff hoping it works :)

libcurl is used on billions of devices across the world and has plenty of debugging capabilities.

MITM proxy works across all languages.

Re: Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code

#30

Post by fragmede »

ricardo81 wrote: post #28
diegoallen wrote: post #24

Earlier quoted context omitted.

If a 3rd party library you depend on has bugs, you have bugs. And you need to either submit a patch to the library or find a workaround.

Or just not use arbitrary 3rd party stuff hoping it works :) libcurl is used on billions of devices across the world and has plenty of debugging capabilities. MITM proxy works across all languages.

The NIH is strong in this once.
Post reply on HN