5 ms·

It has all the same core functionality, plus: - It's open-source - It's cross-platform - It can do all the interception setup for you, for a single specific

It has all the same core functionality, plus: - It's open-source - It's cross-platform - It can do all the interception setup for you, for a single specific target. Fiddler et al set the system proxy, so there's a lot of other traffic going on, and you then need to make applications trust the certificate manually too. Notably some apps (like Node) ignore the system proxy settings entirely, which means you need code changes. HTTP Toolkit does some clever injection, and skips all of that. - Nice & modern UI - Built in docs for all standard HTTP status codes/headers/methods/etc - The Pro features: validation & inline docs from 1400+ API specifications, testing & comparison of compression options, explanations for how your response will be cached & why (and warnings). I keep meaning to do a proper comparison page (any day now), but that's the gist.

nachi 7y ago
What about intercepting requests from other devices on the same network? Fiddler and Charles both let you set a proxy on Android/iOS devices pointing to your instance.
- pimterry 7y ago
  HTTP Toolkit can definitely intercept Android & iOS or other network devices, it just can't do it for you automatically (yet. Watch this space: https://github.com/httptoolkit/feedback/issues/10 https://github.com/httptoolkit/feedback/issues/10). If you want to do intercept something manually, there's general instructions under the 'Anything' interception option. In short: - Set the proxy on the device to point at your machine's local IP, usually on port 8000 (active port is shown under the 'Anything' option) - Trust the generated MITM certificate on your device, so you can intercept HTTPS too (path to the certificate also shown under 'Anything'). Fundamentally, HTTP Toolkit, Charles & Fiddler are all HTTP & HTTPS proxies, so they all allow intercepting the same things, it's just a matter of how easy the setup process is.
  - debatem1 7y ago
    I know it isn't exactly what you're doing, but you might want to look at nogotofail on the Android side. It has all the per-app goodness baked in, and you could probably borrow its approach.
    - pimterry 7y ago
      Interesting! Yeah that definitely looks relevant, I'll take a look.
sebazzz 7y ago
Fiddler is a bit of an ugly duck, and you even have to give your e-mail address away to Telerik. However, it does have scripting ability and supports extensions and one can be very powerful in it if you know what to look for. I actually use extension functionality to extend Fiddler a bit to emulate our internal authenticating proxies we have at work (like PingFederation).
- pimterry 7y ago
  Yeah, eventually I'd love to be able to do scripting etc, but it's dramatically more complicated. There's the language debate to start with. E.g. Fiddler uses JScript.NET, which isn't exactly the language of choice nowadays. Realistically whatever language you choose, you have some big problems. Different groups want different tools, some want external packages, some want data stores, it's a whole thing. It's a good point though, and I'd love to solve it. I've added an issue to my feedback repo to look at it: https://github.com/httptoolkit/feedback/issues/37 https://github.com/httptoolkit/feedback/issues/37. If you've got a minute, could you comment there and record the kind of scripts you'd like to write? I'm not really sure what emulating internal authenticating proxies means in practice, for example. Are you rewriting requests to inject auth params, or validating outgoing requests, or something else?
  - sebazzz 7y ago
    Fiddler also supports C# scripting nowadays.

nachi 7y ago

What about intercepting requests from other devices on the same network? Fiddler and Charles both let you set a proxy on Android/iOS devices pointing to your instance.

pimterry 7y ago
HTTP Toolkit can definitely intercept Android & iOS or other network devices, it just can't do it for you automatically (yet. Watch this space: https://github.com/httptoolkit/feedback/issues/10 https://github.com/httptoolkit/feedback/issues/10). If you want to do intercept something manually, there's general instructions under the 'Anything' interception option. In short: - Set the proxy on the device to point at your machine's local IP, usually on port 8000 (active port is shown under the 'Anything' option) - Trust the generated MITM certificate on your device, so you can intercept HTTPS too (path to the certificate also shown under 'Anything'). Fundamentally, HTTP Toolkit, Charles & Fiddler are all HTTP & HTTPS proxies, so they all allow intercepting the same things, it's just a matter of how easy the setup process is.
- debatem1 7y ago
  I know it isn't exactly what you're doing, but you might want to look at nogotofail on the Android side. It has all the per-app goodness baked in, and you could probably borrow its approach.
  - pimterry 7y ago
    Interesting! Yeah that definitely looks relevant, I'll take a look.

sebazzz 7y ago

Fiddler is a bit of an ugly duck, and you even have to give your e-mail address away to Telerik. However, it does have scripting ability and supports extensions and one can be very powerful in it if you know what to look for. I actually use extension functionality to extend Fiddler a bit to emulate our internal authenticating proxies we have at work (like PingFederation).

pimterry 7y ago
Yeah, eventually I'd love to be able to do scripting etc, but it's dramatically more complicated. There's the language debate to start with. E.g. Fiddler uses JScript.NET, which isn't exactly the language of choice nowadays. Realistically whatever language you choose, you have some big problems. Different groups want different tools, some want external packages, some want data stores, it's a whole thing. It's a good point though, and I'd love to solve it. I've added an issue to my feedback repo to look at it: https://github.com/httptoolkit/feedback/issues/37 https://github.com/httptoolkit/feedback/issues/37. If you've got a minute, could you comment there and record the kind of scripts you'd like to write? I'm not really sure what emulating internal authenticating proxies means in practice, for example. Are you rewriting requests to inject auth params, or validating outgoing requests, or something else?
- sebazzz 7y ago
  Fiddler also supports C# scripting nowadays.