Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Endpoints.dev – Pastebin for HTTP Requests

endpoints.dev

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Show HN: Endpoints.dev – Pastebin for HTTP Requests

#11

Post by bozly »

tyingq wrote: post #10

Is the unique endpoint "secure/random" enough? I imagine you would end up with some amount of live session cookies, tokens, api keys, and so on, that would have some value for people guessing uris. Edit: Ahh, missed the JWT pairing. I read "Pastebin for" too literally.

This was definitely a concern... Each unique subdomain is checked for collision before being assigned, so no two users will receive the same endpoint. Additionally, it is assigned with a jwt, so even if someone was to brute force an endpoint that has been assigned to someone else, they would not be authorized to see the request data.

Re: Show HN: Endpoints.dev – Pastebin for HTTP Requests

#12

Post by tegiddrone »

I like the simplicity! Some of the other options out there are pretty elaborate and not straightforward to get started.

One thing I'm always looking for in these is the docker run one liner. Because if I incorporate a tool into my work, how do I better ensure it's going to stay around by either pragmatic paid plan or OSS self host?

Re: Show HN: Endpoints.dev – Pastebin for HTTP Requests

#13

Post by bozly »

tegiddrone wrote: post #12

I like the simplicity! Some of the other options out there are pretty elaborate and not straightforward to get started. One thing I'm always looking for in these is the docker run one liner. Because if I incorporate a tool into my work, how do I better ensure it's going to stay around by either pragmatic paid plan or OSS self host?

Thanks, simplicity is definitely what I am aiming for!

Making this an OSS project is the direction I plan to take - just need to tidy up the code a bit before making it public :)

The current implementation is serverless on AWS though, and most of the "complexitly" is in the infrastructure, so as convenient as they are, I don't think I'll aim to dockerize it.

Re: Show HN: Endpoints.dev – Pastebin for HTTP Requests

#15

Post by osapy »

bozly wrote: post #2

I've just released endpoints.dev - Use it to get a unique, private url that will store & display all http requests made to it. Use your unique URL with 3rd party tools to see what requests they are making, without needing to spin up a webserver. Or, use it for experimenting with XXS, phone-home, and other http based pen-testing.

Very cool. You can also use osapy.com to inspect 3rd party API requests. Or even combine Osapy with endpoints.dev. I wrote a blogpost how to do that for retool.

In which direction do you want to develop the website?

Re: Show HN: Endpoints.dev – Pastebin for HTTP Requests

#16

Post by osapy »

osapy wrote: post #15
bozly wrote: post #2

I've just released endpoints.dev - Use it to get a unique, private url that will store & display all http requests made to it. Use your unique URL with 3rd party tools to see what requests they are making, without needing to spin up a webserver. Or, use it for experimenting with XXS, phone-home, and other http based pen-testing.

Very cool. You can also use osapy.com to inspect 3rd party API requests. Or even combine Osapy with endpoints.dev. I wrote a blogpost how to do that for retool. In which direction do you want to develop the website?

Actually - just tried your website and it doesn't work for me. I tried curl -H "Content-Type: application/json" -d '{"message":"hello world"}' https://8ef216dd46.endpoints.dev and nothing happened. Maybe check your logs.

Re: Show HN: Endpoints.dev – Pastebin for HTTP Requests

#17

Post by osapy »

osapy wrote: post #16
osapy wrote: post #15

Earlier quoted context omitted.

Very cool. You can also use osapy.com to inspect 3rd party API requests. Or even combine Osapy with endpoints.dev. I wrote a blogpost how to do that for retool. In which direction do you want to develop the website?

Actually - just tried your website and it doesn't work for me. I tried curl -H "Content-Type: application/json" -d '{"message":"hello world"}' https://8ef216dd46.endpoints.dev and nothing happened. Maybe check your logs.

oh. you don't have live-updating. Sorry it works then.

Re: Show HN: Endpoints.dev – Pastebin for HTTP Requests

#18

Post by bozly »

osapy wrote: post #16
osapy wrote: post #15

Earlier quoted context omitted.

Very cool. You can also use osapy.com to inspect 3rd party API requests. Or even combine Osapy with endpoints.dev. I wrote a blogpost how to do that for retool. In which direction do you want to develop the website?

Actually - just tried your website and it doesn't work for me. I tried curl -H "Content-Type: application/json" -d '{"message":"hello world"}' https://8ef216dd46.endpoints.dev and nothing happened. Maybe check your logs.

hmm - I can see a few requests have been received & stored for that endpoint.. It could be that your client killed the connection to the websocket api - does refreshing the page show the requests?

Re: Show HN: Endpoints.dev – Pastebin for HTTP Requests

#19

Post by bozly »

osapy wrote: post #17
osapy wrote: post #16

Earlier quoted context omitted.

Actually - just tried your website and it doesn't work for me. I tried curl -H "Content-Type: application/json" -d '{"message":"hello world"}' https://8ef216dd46.endpoints.dev and nothing happened. Maybe check your logs.

oh. you don't have live-updating. Sorry it works then.

Live updating should work - I'll investigate if there's any issues with the websocket api :)

Re: Show HN: Endpoints.dev – Pastebin for HTTP Requests

#20

Post by emiunet »

bozly wrote: post #11
tyingq wrote: post #10

Is the unique endpoint "secure/random" enough? I imagine you would end up with some amount of live session cookies, tokens, api keys, and so on, that would have some value for people guessing uris. Edit: Ahh, missed the JWT pairing. I read "Pastebin for" too literally.

This was definitely a concern... Each unique subdomain is checked for collision before being assigned, so no two users will receive the same endpoint. Additionally, it is assigned with a jwt, so even if someone was to brute force an endpoint that has been assigned to someone else, they would not be authorized to see the request data.

If I knew somebody else's unique subdomain, I could set my browser cookie on my local computer to that value and it seems to just load the other subdomain just fine. I tested this with 2 different browser on my same laptop. Maybe it won't work if the other person is on another computer?

I could also just set the subdomain to anything I like (by setting the cookie value) and it still works just fine.

Ah no, I can still set the cookie to the other person's subdomain on another machine.

Edit: add extra sentence.

Edit2: format.

Post reply on HN