Is this something that could be used in a CI pipeline as well?
Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup
21–30 of 86 posts
Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup
#22How is this achieving https interception with zero setup? Does that not require a system-level root CA to be installed and trusted?
> Does that not require a system-level root CA to be installed and trusted?
No, happily :-)
The trick is that it starts the application to be intercepted for you, so it can control it a little. It then does some magic to get that specific instance of the application to trust the certificate. There's a lot going on there, but as an example: Chrome has a --ignore-certificate-errors-spki-list to inject the hashes of extra CAs that can be trusted in this specific Chrome instance. When HTTP Toolkit starts a Chrome process, it adds that command line option, with the hash of your locally generated CA.
There's nothing here with a lasting effect, and other running apps on your machine won't trust HTTP Toolkit unless you specifically configure them to. Only the processes spawned by HTTP Toolkit trust your CA, which avoids a lot of the downside of other similar tools like this.
Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup
#23Is this something that could be used in a CI pipeline as well?
As a UI desktop app, not really, although it depends what you're trying to do. However, the internals are all open-source too, so you can use them standalone and automate HTTP & HTTPS with that. Take a look at https://github.com/httptoolkit/mockttp
Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup
#24Love it. We definitely need a fiddler in macosx.
Charles is pretty good, though it’s paid. It’s definitely nice to have an opensource tool, though.
Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup
#25Earlier quoted context omitted.
Huh, that shouldn't happen! What browser & OS are you using?
I'm getting the same on Chrome/Mac. Requesting /mock/ just 301's me back to /mock/ https://pastebin.com/vmgSU6nj
Hmm, no idea. I'm using Chrome on a Mac, and it works fine, and my analytics suggest at least 400 other Chrome+Mac users have been getting through, so it's not a general problem...
Any chance you can export a HAR from your browser dev tools and send it to help@httptoolkit.tech? There's something very odd happening there, could be a Netlify bug.
Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup
#26Is intercepting Android traffic planned?
Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup
#27Is intercepting Android traffic planned?
Yes, definitely! You can follow progress by subscribing to this GH issue: https://github.com/httptoolkit/feedback/issues/10 (or signing up to the general HTTP Toolkit mailing list ofc).
In the meantime, it's quite possible to intercept Android traffic, it's just that you'll have to do the proxy & certificate setup yourself.
Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup
#28There are full opensource alternative for this? I like the product, I'm testing it right now. But I'm curious if there is a way to accomplish something like this with existing opensource tools or a similar full opensource project.
Would not be able to exactly explain the features and differences, but https://mitmproxy.org/ is a similar project you might be interested in.
mitmproxy is indeed a similar project.
It offers a dashboard similar to devtools (no modifying in there though).
You can, however, write small python scripts that have read-write access to the http flow (request and response objects).
I guess it's a more low level tool, because it doesn't provide mocking and other helpful tools out of the box.
Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup
#29Is intercepting Android traffic planned?
Yes, definitely! You can follow progress by subscribing to this GH issue: https://github.com/httptoolkit/feedback/issues/10 (or signing up to the general HTTP Toolkit mailing list ofc). In the meantime, it's quite possible to intercept Android traffic, it's just that you'll have to do the proxy & certificate setup yourself.
That's great, thanks for the link! In recent Android versions it has become difficult to inspect the traffic precisely because certificates installed by users are no longer trusted, so one has to either root the phone or modify the apk.
Do you plan to automate app repackaging with the needed changes, or is there a better method for apps to trust local certificates?
Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup
#30Would be cool to have something like this for debugging outgoing container traffic in Kubernetes.