Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

httptoolkit.tech

Post reply on HN
Print view View original

41–50 of 86 posts

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#41

Post by debatem1 »

pimterry wrote: post #35
debatem1 wrote: post #33

Earlier quoted context omitted.

So, I'm confused. Does this work on a set of programs where you know eg the right command line parameters to give them or on all programs? For example, let's say I have a program which uses the openssl API to set a custom trust store. Do you mess with openssl to make sure your cert is in there, or will this break?

It works on a set of programs, plus terminal interception that works on anything (more or less) that you spawn from the given terminal. For that terminal interception, HTTP Toolkit injects a lot of environment variables, including adding some wrappers to your path, which allow it to inject into a _lot_ of places. It sets `SSL_CERT_FILE` for example, which reconfigures the default CA for any processes started from tha…

At that point why not just LD_PRELOAD and hook the creation of all cert stores?

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#42

Post by pimterry »

xyzzy_plugh wrote: post #39
pimterry wrote: post #11

Earlier quoted context omitted.

HTTP Toolkit is fully open source, primarily AGPL: https://github.com/httptoolkit/ . That includes the Pro version too - it's not open core, it's just open source all the way down. There are other tools that exist anyway, but all the big ones (Fiddler & Charles, for Windows & OSX respectively) are very much closed source. The other similar open source competitor I'm familiar with is James Proxy ( https://github.com/j…

The parent was likely referring to AGPL, a somewhat-encumbered copyleft license, which most folks working in proprietary software are hesitant to touch. They are probably looking for a non-copyleft license. Though, as a development tool, I don't see any issues using AGPL software.

Could be! It's all open-source but actually not all AGPL: the core desktop app is, but the internal libraries like https://github.com/httptoolkit/mockttp are generally MIT or Apache 2, so if you're looking to dig into and use those internals, it's pretty thoroughly unencumbered.

It's really just the runnable desktop app part that's AGPL. That encumbers you if you're making a directly derivative work (no running off with the whole app but closing the source, thank you), but otherwise it shouldn't limit you at all. This isn't like using a (A)GPL library in your codebase; it's a full application and you're an end user.

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#43

Post by pimterry »

debatem1 wrote: post #41
pimterry wrote: post #35

Earlier quoted context omitted.

It works on a set of programs, plus terminal interception that works on anything (more or less) that you spawn from the given terminal. For that terminal interception, HTTP Toolkit injects a lot of environment variables, including adding some wrappers to your path, which allow it to inject into a _lot_ of places. It sets `SSL_CERT_FILE` for example, which reconfigures the default CA for any processes started from tha…

At that point why not just LD_PRELOAD and hook the creation of all cert stores?

I did look at it! It's still an option in my back pocket if I find things that don't work nicely, but right now this is much easier. I'd need to use LD_PRELOAD to hook lots of different libraries and tools (OpenSSL is just the start, and I also need to hook proxy settings), plus handle different versions of the hooked libs, and make it work reliably on Windows & Linux & Mac.

AFAICT, it's hard to do everywhere reliably for the general case, though as I say I might use it for specific niche cases later. At the moment there's zero native code required in this terminal hooking, which is very nice, and it's very nearly identical logic for all platforms too. It's not so bad, right now it's less than 1000 lines of code in total, and it works out of the box for Python/Node/Ruby/PHP/curl/npm/apt-get, etc etc etc.

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#44

Post by pimterry »

pault wrote: post #40
pimterry wrote: post #2

Hey HN! I've been building this for a while, but up until now it's been a read-only HTTP debugging tool, and today's my first foray into proper mocking, which opens up a whole new world of fun (and practical use cases). Let me know what you think :-)

I hope this works out! Using fiddler us such a frustrating experience. The documentation is practically non existent and the ux is atrocious, and as far as I can tell the closest thing to a manual is a paid ebook by the developer (I was so pissed when I discovered this). I would be very happy to have an open source alternative!

Me too :-). I built this myself in large part because of frustrations with Fiddler. It was an amazing tool at the time, but it hasn't aged well imo...

Hopefully this is your open source alternative - give it a go, let me know if there's something Fiddler does for you that HTTP Toolkit doesn't!

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#46

Post by chrismatheson »

pimterry wrote: post #23
chrismatheson wrote: post #21

Is this something that could be used in a CI pipeline as well?

As a UI desktop app, not really, although it depends what you're trying to do. However, the internals are all open-source too, so you can use them standalone and automate HTTP & HTTPS with that. Take a look at https://github.com/httptoolkit/mockttp

I think (maybe postman) had a nice gui, and then the same mocks could be loaded up as part of a test. I was thinking more along the lines of how the application actually inspects network traffic, is that something that could be setup & torn down within a unprivileged docker container for example?

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#47

Post by miles »

meritt wrote: post #19

How is this achieving https interception with zero setup? Does that not require a system-level root CA to be installed and trusted?

Netripper[0] can also intercept HTTPS with zero setup via DLL injection. I cobbled together a simple guide[1] on its use, though for Chrome, signature changes have made it a bit more challenging[2].

[0] https://github.com/NytroRST/NetRipper

[1] https://tinyapps.org/blog/201508150700_sniffing_encrypted_tr...

[2] https://github.com/NytroRST/NetRipper/issues/21

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#48

Post by pimterry »

chrismatheson wrote: post #46
pimterry wrote: post #23

Earlier quoted context omitted.

As a UI desktop app, not really, although it depends what you're trying to do. However, the internals are all open-source too, so you can use them standalone and automate HTTP & HTTPS with that. Take a look at https://github.com/httptoolkit/mockttp

I think (maybe postman) had a nice gui, and then the same mocks could be loaded up as part of a test. I was thinking more along the lines of how the application actually inspects network traffic, is that something that could be setup & torn down within a unprivileged docker container for example?

Yes, that's exactly what you'd want Mockttp for.

It's a Node.js library, so you'd need a Node container and a little script to configure it. Mockttp can spin up an HTTP/HTTPS proxy configured to pass through traffic in a couple of lines, and from there you can add any other mocking rules you want (the Mock tab here is really just a UI over this) and you can subscribe to requests/responses/whatever and report that data elsewhere in any form you'd like (that's where all the data shown in the View tab here comes from).

The details get more complicated of course, but it's definitely possible.

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#50

Post by pimterry »

jordache wrote: post #49

why do I need to create an account for this? gawd... I just need a Fiddler in macOS... one can't really improve what Fiddler provides.

You don't need to create an account for this! Click download, use the app, it's fine.

You can provide your email after download if you want updates from the mailing list (or you can not), and you can click 'Get Pro' somewhere and provide your email if you want a paid Pro account. The core app will give you pretty much everything Fiddler does though, on Mac, and doesn't require your email or anything else.

Post reply on HN