Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

httptoolkit.tech

Post reply on HN
Print view View original

51–60 of 86 posts

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#51

Post by atleta »

pimterry wrote: post #43
debatem1 wrote: post #41

Earlier quoted context omitted.

At that point why not just LD_PRELOAD and hook the creation of all cert stores?

I did look at it! It's still an option in my back pocket if I find things that don't work nicely, but right now this is much easier. I'd need to use LD_PRELOAD to hook lots of different libraries and tools (OpenSSL is just the start, and I also need to hook proxy settings), plus handle different versions of the hooked libs, and make it work reliably on Windows & Linux & Mac. AFAICT, it's hard to do everywhere reliabl…

You could maybe catch file open and read operations and return your CA cert if/when the proxied app tries to read the cert files.

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#52

Post by kevinday »

pimterry wrote: post #25
kevinday wrote: post #18

Earlier quoted context omitted.

I'm getting the same on Chrome/Mac. Requesting /mock/ just 301's me back to /mock/ https://pastebin.com/vmgSU6nj

Hmm, no idea. I'm using Chrome on a Mac, and it works fine, and my analytics suggest at least 400 other Chrome+Mac users have been getting through, so it's not a general problem... Any chance you can export a HAR from your browser dev tools and send it to help@httptoolkit.tech? There's something very odd happening there, could be a Netlify bug.

It's working now - nothing changed as far as I know on my end, but if it happens again I'll do that.

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#53

Post by pimterry »

kevinday wrote: post #52
pimterry wrote: post #25

Earlier quoted context omitted.

Hmm, no idea. I'm using Chrome on a Mac, and it works fine, and my analytics suggest at least 400 other Chrome+Mac users have been getting through, so it's not a general problem... Any chance you can export a HAR from your browser dev tools and send it to help@httptoolkit.tech? There's something very odd happening there, could be a Netlify bug.

It's working now - nothing changed as far as I know on my end, but if it happens again I'll do that.

How bizarre, might be a Netlify hiccup somewhere? No idea, but I'm glad it's working now!

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#54

Post by bdcravens »

I understand why you're doing it, but the download link redirecting me to an email capture page is quite jarring. If your download link is at the top of your homepage, and there's more product details below that link, it's pretty typical to hit download and assume it's a normal download link while you read the rest of the page. An easily dismissible modal would work better (or put an email capture in your app on first-run)

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#55

Post by insomniacity »

pimterry wrote: post #11
mariocesar wrote: post #4

There are full opensource alternative for this? I like the product, I'm testing it right now. But I'm curious if there is a way to accomplish something like this with existing opensource tools or a similar full opensource project.

HTTP Toolkit is fully open source, primarily AGPL: https://github.com/httptoolkit/ . That includes the Pro version too - it's not open core, it's just open source all the way down. There are other tools that exist anyway, but all the big ones (Fiddler & Charles, for Windows & OSX respectively) are very much closed source. The other similar open source competitor I'm familiar with is James Proxy ( https://github.com/j…

I've not looked at the code, but wouldn't it be possible to patch this and enable Pro mode without paying?

Morally bad and ultimately self-defeating, but I'm guessing legally fine?

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#56

Post by pimterry »

insomniacity wrote: post #55
pimterry wrote: post #11

Earlier quoted context omitted.

HTTP Toolkit is fully open source, primarily AGPL: https://github.com/httptoolkit/ . That includes the Pro version too - it's not open core, it's just open source all the way down. There are other tools that exist anyway, but all the big ones (Fiddler & Charles, for Windows & OSX respectively) are very much closed source. The other similar open source competitor I'm familiar with is James Proxy ( https://github.com/j…

I've not looked at the code, but wouldn't it be possible to patch this and enable Pro mode without paying? Morally bad and ultimately self-defeating, but I'm guessing legally fine?

Absolutely! In fact AGPL v3 guarantees that right (otherwise in the US I think arguably the DMCA blocks breaking access protections like that).

In practice, I'm not too worried. It's a fair bit of a hassle, as you'd have to rebuild everything yourself. It'd also require a fork that would make keeping up to date with the main versions new features painful, and it's been moving pretty quickly!

It's only a few dollars a month, if that's expensive enough for you that the time & hassle to fork the whole thing would be worthwhile, email me at tim@httptoolkit.tech and I'll just give you a free subscription.

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#57

Post by sebazzz »

pimterry wrote: post #12
sebazzz wrote: post #8

How does this compare Fiddler?

It has all the same core functionality, plus: - It's open-source - It's cross-platform - It can do all the interception setup for you, for a single specific target. Fiddler et al set the system proxy, so there's a lot of other traffic going on, and you then need to make applications trust the certificate manually too. Notably some apps (like Node) ignore the system proxy settings entirely, which means you need code c…

Fiddler is a bit of an ugly duck, and you even have to give your e-mail address away to Telerik. However, it does have scripting ability and supports extensions and one can be very powerful in it if you know what to look for.

I actually use extension functionality to extend Fiddler a bit to emulate our internal authenticating proxies we have at work (like PingFederation).

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#58

Post by insomniacity »

pimterry wrote: post #56
insomniacity wrote: post #55

Earlier quoted context omitted.

I've not looked at the code, but wouldn't it be possible to patch this and enable Pro mode without paying? Morally bad and ultimately self-defeating, but I'm guessing legally fine?

Absolutely! In fact AGPL v3 guarantees that right (otherwise in the US I think arguably the DMCA blocks breaking access protections like that). In practice, I'm not too worried. It's a fair bit of a hassle, as you'd have to rebuild everything yourself. It'd also require a fork that would make keeping up to date with the main versions new features painful, and it's been moving pretty quickly! It's only a few dollars a…

Yes, you're probably right about the DMCA. Would be a fascinating test case, given the availability of the source under an open license! But of course, will never happen.

I think I more saw it as a challenge to be honest! But if I do get to that point in the future I may take up your generous offer.

Great README docs by the way - spot on in content and delivery!

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#59

Post by pimterry »

sebazzz wrote: post #57
pimterry wrote: post #12

Earlier quoted context omitted.

It has all the same core functionality, plus: - It's open-source - It's cross-platform - It can do all the interception setup for you, for a single specific target. Fiddler et al set the system proxy, so there's a lot of other traffic going on, and you then need to make applications trust the certificate manually too. Notably some apps (like Node) ignore the system proxy settings entirely, which means you need code c…

Fiddler is a bit of an ugly duck, and you even have to give your e-mail address away to Telerik. However, it does have scripting ability and supports extensions and one can be very powerful in it if you know what to look for. I actually use extension functionality to extend Fiddler a bit to emulate our internal authenticating proxies we have at work (like PingFederation).

Yeah, eventually I'd love to be able to do scripting etc, but it's dramatically more complicated.

There's the language debate to start with. E.g. Fiddler uses JScript.NET, which isn't exactly the language of choice nowadays. Realistically whatever language you choose, you have some big problems. Different groups want different tools, some want external packages, some want data stores, it's a whole thing.

It's a good point though, and I'd love to solve it. I've added an issue to my feedback repo to look at it: https://github.com/httptoolkit/feedback/issues/37. If you've got a minute, could you comment there and record the kind of scripts you'd like to write?

I'm not really sure what emulating internal authenticating proxies means in practice, for example. Are you rewriting requests to inject auth params, or validating outgoing requests, or something else?

Re: Show HN: HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup

#60

Post by donaldihunter »

Nodraak wrote: post #10
mariocesar wrote: post #4

There are full opensource alternative for this? I like the product, I'm testing it right now. But I'm curious if there is a way to accomplish something like this with existing opensource tools or a similar full opensource project.

Would not be able to exactly explain the features and differences, but https://mitmproxy.org/ is a similar project you might be interested in.

Yep, mitmproxy is my go-to tool, but HTTP Mock maybe wins for zero-setup convenience.
Post reply on HN