14 ms·

HTTP Toolkit

538 points by hliyan 5y ago

Kwai907168326 5y ago
goalieca 5y ago
I’ve been looking for an alternative to postman that isn’t so insanely geared to monetization. I feel postman compromises it’s entire UX to force a simple offline tool to be cloud based.
- meibo 5y ago
  I used to recommend https://insomnia.rest/ https://insomnia.rest/ as it was a free, sleek alternative... Alas it's been bought by Kong and enterprise'd up the same way. Not as bad yet, but can't be long.
  - vladvasiliu 5y ago
    For the time being it's still OK. It asked me once to try the "premium" version or whatever it's called, I said no, and it never bothered me again. I don't know what licence Postman uses. A quick search on GitHub didn't turn up the source of the app on the Postman Labs page. Insomnia is MIT [0], so it could still be forked if Kong got decided to stop supporting the free version. [0] https://github.com/Kong/insomnia/blob/develop/LICENSE https://github.com/Kong/insomnia/blob/develop/LICENSE
    - chrisweekly 5y ago
      I still like Insomnia too.
    - meibo 5y ago
      I actually wasn't aware of it being open source at all, thanks. It's not mentioned anywhere on their page, gives me a bit more confidence :)
  - pull_my_finger 5y ago
    Why would you think Kong would spoil it? Their main product is an API gateway, it makes sense to have a nice HTTP client under their umbrella. Kong is also open source and almost all of their plugins are freely available. I actually tried (and still use) Insomnia _because_ it was affiliated with Kong. YMMV but I've had no complaints about Insomnia at all.
  - udfalkso 5y ago
    Insomnia is great, I use it daily. Highly reccommend.
  - squeaky-clean 5y ago
    Am I having a Mandela Effect moment or did Insomnia used to be Mac only? I remember seeing it a long time ago and being disappointed I couldn't use it. Now I'm doubting my memory, lol. Either way thanks for the recommendation/reminder for Insomnia, it looks so much better than the current version of postman.
    - easton 5y ago
      You aren’t thinking of Paw, are you? https://paw.cloud/ https://paw.cloud/
    - phunehehe0 5y ago
      You are not alone! I just checked the Git history and it seems we were indeed mistaken, at least since 2017. It might have been just hard to see from the website. "Insomnia is available for Mac, Windows, and Linux and can be downloaded from http://insomnia.rest/download/ http://insomnia.rest/download/" https://github.com/Kong/insomnia/commit/23cca8c42b80aa6d9de23f0964f34258385afe76 https://github.com/Kong/insomnia/commit/23cca8c42b80aa6d9de2...
- deleted 5y ago
  [deleted]
- thecopy 5y ago
  I can recommend https://paw.cloud/ https://paw.cloud/ for MacOS
  - mariusseufzer 5y ago
    I second this. It’s not open source, yes, but it’s a fair one-time payment. No subscription or anything!
    - BillinghamJ 5y ago
      They did shift to a subscription model for team use unfortunately: https://paw.cloud/pricing https://paw.cloud/pricing And were recently acquired, so likely to continue down that path: https://blog.paw.cloud/paw-joins-forces-with-rapidapi/ https://blog.paw.cloud/paw-joins-forces-with-rapidapi/ My previous company was an early & very heavy user of Paw - with thousands of endpoints in our project. Unfortunately at that scale, it has some major problems, particularly with syncing. A friend of mine has been working on https://getbeak.app https://getbeak.app to try and address those problems, but it's quite early stage still
      - haswell 5y ago
        I realize that certain UI patterns are going to inevitably overlap in this space, but this looks like a literal clone of Paw. Seems questionable.
        jen20 5y ago
        It also does not solve the problem of subscription pricing - it's $25/year with no obvious one-time payment option.
- gadrev 5y ago
  For simple requests where it's just convenient to have them in a list, with a description/easy to find for replaying, a VSCode extension like Rest Client [0] can be useful instead of the desktop apps. Well, VSCode is a desktop app too, but if you already use it... :P I like it because you can just write a text file with the request and any comments you need around them, and... being just text, it's so easy to manipulate. When I need scripts for special auth I fall back to postman though, haven't digged enough to see if I can make it work with that addon (or any other one). Also there's Thunder Client [1] which I haven't tried but apparenly has more features. EDIT: references [0] https://github.com/Huachao/vscode-restclient https://github.com/Huachao/vscode-restclient [1] https://www.thunderclient.io/ https://www.thunderclient.io/
  - vbezhenar 5y ago
    If you're using Intellij Idea, it supports similar http requests as well. Very convenient as those are just text files.
    - hdjrudni 5y ago
      IntelliJ rewrote this awhile back...used to be more GUI heavy. As much as I love text, it's harder to manipulate the GET vars now :\
  - nine_k 5y ago
    Same thing is available for Emacs. I suspect that Vim, Sublime, or Notepad++ should likely already have a good equivalent of it, too.
    - dpipemazo 5y ago
      Sublime has requester which works quite well if you’re familiar with the Python requests syntax. You write the query in the equivalent Python line and then use some hotkeys to execute/send it. Variables can be used/stored in the file for common, verbose variables such as auth tokens. The response comes back in a new tab and it’s fairly easy to search through.
  - 5y ago
- ananthakumaran 5y ago
  After having used postman for sometime, I realized it favors mouse click based workflow and is very resource heavy. I have switched to emacs verb[1] package and combined with some custom function for env (staging/local) management and org-roam for file management, it's much more comfortable to use. I don't have to learn a new set of shortcuts and can use all the other emacs features. [1]: https://github.com/federicotdn/verb https://github.com/federicotdn/verb
- pletnes 5y ago
  Monetization dark patterns is one thing. But how on earth do they lure people away from the good old plaintext-in-git workflow? I found everything about postman to be anti-git in nature, and then I lose versioning, CI/CD becomes weird, etc. I just don’t see the advantage for teams. If you’re a lone wolf developer who prefers a GUI - fine. But then, why pay up for the «pro» service?
  - vladvasiliu 5y ago
    I've seen this used by people who are not quite devs but work with devs, as in not-really-technical PMs. They're happy to not have to deal with git, but they still need to see that some API replies with the expected result. They absolutely love postman.
    - pletnes 5y ago
      Sure thing, but why not keep the source in git, then distribute to end users, as we do with other software artifacts?
      - vladvasiliu 5y ago
        I may be mistaken since I'm not directly a part of this, but the way I understand this works is the other way around: it's the PMs who more or less come up with the API specs / explore upstream APIs, and it's also them who will do the querying. So they're the "first" as well as the "main" users of those collections. So basically, as they expect to be able to write their own requests and save / share them, they would have to either directly interact with git (which they'd rather avoid - at all) either have the "real devs" provide some kind of functionality similar to postman but backed by git. Needless to say, we're not in the business of developing a postman competitor, so devs have other things to do.
  - squeaky-clean 5y ago
    In my experience, people aren't buying the pro version of Postman as solo/indie developers. Companies purchase it for their QA team, or for technical but non-developer roles that need to make requests, share them among teammates, and keep a cloud-sync'd collection of them.
- dylanowen 5y ago
  100% agree. After postman asked me to make an account I uninstalled it and have been building my own. It's not all wired together yet but I'm using this fork of https://github.com/dylanowen/dot-http/tree/wasm-library https://github.com/dylanowen/dot-http/tree/wasm-library I wanted something where I could store and share my requests over git instead of creating some random account. I also wanted the api description to be text not a UI+JSON blob. I also made this https://github.com/dylanowen/sublime-dot-http https://github.com/dylanowen/sublime-dot-http
- adolph 5y ago
  I don't think this is necessarily an alternative to Postman. It is more like an alternative to Fiddler or other mitm network traffic analysis tools oriented around 80/443 HTTP. The best alternative to Postman is curl coupled with jq and xmllint.
  - wilmoore 5y ago
    If you like jq, then you might also like jmespath.terminal (jpterm): https://github.com/jmespath/jmespath.terminal https://github.com/jmespath/jmespath.terminal
- aedocw 5y ago
  I'm really surprised no one else has mentioned this so far, but Hoppscotch (formerly postwoman) is an excellent open alternative: https://github.com/hoppscotch/hoppscotch https://github.com/hoppscotch/hoppscotch
- izyda 5y ago
  How about HTTPie: https://httpie.io/ https://httpie.io/ Well known for the CLI, they now have a web/desktop client as well.
  - the_arun 5y ago
    HTTPie is simple to use from command line. I use it for testing our apis.
- vogre 5y ago
  I use jupiter notebook. It allows writing and saving requests, in much more convenient(for me) way than postman does
ocdtrekkie 5y ago
I'm not sure if it's only because I'm on mobile, but the "enter your email to download" thing gives me weird marketing stuff vibes. I find it a weird touch on open source software I presumably can get without giving them my email.
- IceWreck 5y ago
  I tried it, it started the download and gave the enter email box at the same time. So its optional.
- pimterry 5y ago
  I'm the creator of HTTP Toolkit - you don't need to share your email to use it. It is a desktop app though, so you can't download it usefully on mobile. If you visit the landing page on mobile, it just offers to take your email address and send download links to your computer to get you started (and as an easy "bookmark this for later" option). That sends one follow up "Did you try it? Let me know what you think" email a week later, then it deletes your email, that's it. It's never shared elsewhere, it doesn't sign you up to the mailing list, there are no "great new offers", nada. Meanwhile, if you're on desktop it just shows a download button directly. After that starts it asks if you want to join the mailing list for updates, but you don't need to - the download starts immediately.
  - cyberge99 5y ago
    This is exactly what should be noted. You’ll probably get more signups if people know how it’s going to be used.
  - ocdtrekkie 5y ago
    I both understand the goal there, since indeed I can't meaningfully download it on mobile, but I would also point out many others will get the same vibes I noted above from it. Which is probably just to say after being burned too many times by bad actors, folks will start to group good actors in the same lot for similar patterns, even if the intent and design is better.
yolo3000 5y ago
How is this decrypting https out of the box, while with Charles proxy I needed to install a root certificate?
- kevinbowman 5y ago
  From a quick look at the code, it seems to be doing something similar, except it does it for you. Here's a link to the Firefox bit, where it makes a custom Firefox profile and then injects a certificate into it: https://github.com/httptoolkit/httptoolkit-server/blob/master/src/interceptors/fresh-firefox.ts#L220 https://github.com/httptoolkit/httptoolkit-server/blob/maste... I haven't seen the source for the .deb package, but in theory it could add a system cert at installation time. I don't know if it does, though.
  - pimterry 5y ago
    I'm the author, that's exactly it! The contents of that interceptors folder should give you an idea how it all works: https://github.com/httptoolkit/httptoolkit-server/tree/master/src/interceptors https://github.com/httptoolkit/httptoolkit-server/tree/maste... It actually doesn't install system certificates at all though. It doesn't change any system configuration whatsoever, and it doesn't need any admin/root privileges. The deb package doesn't do anything different to any others. That's because the key differentiator of HTTP Toolkit vs Fiddler/Charles/mitmproxy etc, is that it provides targeted interception, rather than intercepting your entire system at once. That works by injecting cert & proxy config into a single browser window, intercepting specific Android apps, targeting individual Docker containers etc. That way you get much less noisy intercepted traffic for your debugging, and you can freely add rules to rewrite/break traffic without interfering with anything else. You can even open two HTTP Toolkit windows on one machine, and intercept things separately into each one. If you want, you can still do the normal steps to do full system interception manually if you'd prefer that, but by default it uses entirely transient and permissionless targeted interception instead, and that's almost always the better approach.
    - kevinbowman 5y ago
IceWreck 5y ago
a) This has less features than mitmproxy, burp suite or owasp zap. b) Export request is a very essential feature that's available for free in either of these alternatives and its pay-walled here. c) Intercept request in a terminal very badly broken. It broke (go get) and probably breaks others. I expect it adds an environment variable (which can be ignored by an application) or uses LD_PRELOAD (which doesn't work in statically linked applications). Other than that, it functions like you would expect it to. Worked out of the box for Firefox and curl.
- pimterry 5y ago
  I'm the author. I'm not a Go developer though, can you give me an example I can reproduce for `go get` that doesn't work for you? For the terminal, there's a few mechanisms, but environment variables are the catch-all there, yes (full list: https://github.com/httptoolkit/httptoolkit-server/blob/master/src/interceptors/terminal/terminal-env-overrides.ts https://github.com/httptoolkit/httptoolkit-server/blob/maste...). Those do work for most cases, but it is absolutely not a hard guarantee for applications that actively ignore standard proxy configuration (handling that is very hard, and definitely out of scope here). Go does generally observes `http_proxy` correctly by default in other cases I've tested, so this vert simple code from the test suite is automatically intercepted for example: https://github.com/httptoolkit/httptoolkit-server/blob/master/test/fixtures/docker/go/app.go https://github.com/httptoolkit/httptoolkit-server/blob/maste.... Very happy to look into any failing cases you can share.
  - IceWreck 5y ago
    Yes, go based programs observe the proxy variable unless specifically compiled not to. But that doesn't break applications, they just ignore the env var. Go's default package manager doesn't seem to work at all with HTTP Toolkit. Here's what I did. * Intercept Tab > Fresh terminal. * In the terminal, do your usual stuff, it intercepts curl, etc. * If you try to use go's package manager, example: `go get golang.org/x/oauth2` It errors out with ``` go get: module golang.org/x/oauth2: reading http://127.0.0.1:8000/golang.org/x/oauth2/@v/list http://127.0.0.1:8000/golang.org/x/oauth2/@v/list: 500 Server error ``` Ideally it shouldn't break the application, just ignore if it can't intercept. > absolutely not a hard guarantee for applications that actively ignore standard proxy configuration (handling that is very hard, and definitely out of scope here). I encountered a usecase where this was needed and LD_PRELOAD trick (used by proxychains) etc failed because the application was statically compiled. I ended up using https://github.com/hmgle/graftcp https://github.com/hmgle/graftcp which somehow manages to force tcp traffic through a socks5 proxy.
can16358p 5y ago
This would be great but it doesn't have the only features I truly need: intercepting HTTPS connections from iOS apps. I understand that intercepting HTTPS might be a bit complicated for iOS and still think this is a great project though!
- s_dev 5y ago
  Maybe you need something like Charles Proxy or Proxyman?
  - can16358p 5y ago
    Yeah, but a streamlined "just works" setup would be much more useful (which the project really aims on). Otherwise, yeah it's possible, but again, it has always been possible with more complicated (compared to this) tools anyway.
- kevinbowman 5y ago
  I think Charles proxy can do that, by installing itself as a VPN on iOS devices and also as a device configuration profile (so it can use a custom CA to MITM the traffic).
- pimterry 5y ago
  I'm the author. Yes, I'm afraid automatic iOS interception isn't available yet, but it's definitely planned for the future! You can subscribe to the GitHub issue here for updates: https://github.com/httptoolkit/httptoolkit/issues/11 https://github.com/httptoolkit/httptoolkit/issues/11 In the meantime it's still totally possible to intercept iOS devices, but you just have to do the initial setup manually unfortunately.
  - can16358p 5y ago
    Lovely! Looking forward for a automated-iOS setup (at least as much as the walled garden" permits). Keep up the good work!
FreeHugs 5y ago
It would be cool if something like this would be possible with standard Linux tools on the command line. How hard would it be to implement a network rule "if http://abc.com/def http://abc.com/def is requested reply with this data: ..."? Or is it possible to inject something like this on the fly into Apache? Would be very nice to mock end-2-end tests.
- marcosdumay 5y ago
  I'm not sure what you are expecting that isn't a main feature of Apache. I imagine you expect something like a CGI script with mod-rewrite, but your comment only actually requires plain Apache. A network rule of "if URL is requested reply with this data" is implemented by putting a file at the expected place.
  - dotancohen 5y ago
    > only actually requires plain Apache ... and a hosts file entry. Still, trivial for any machine that the operator administers.
- cedricvanrompay 5y ago
  Note that HTTPS, unlike says VPNs (IPSec, Wireguard...), provides authenticity protection up to the application itself. If the kernel sends a modified packet to the application, it will be rejected by the application. As a result, to implement HTTPS interception / rewrite / injection you need some degree of modification of the application itself. The "minimal" way is to add a new TLS certificate to the certificate trust store the application uses that is marked as "allowed for every domain" (that's what Burp suite does). It seems that HTTP toolkit does it differently for the browsers it supports, probably a plugin/extension added to the browser that alters the traffic after the TLS block (HTTPS is HTTP over TLS)
  - cjcampbell 5y ago
    No plug-in or extension. I dug in when I first learned about it because I wanted to make sure I understood how it would impact browser security when it was not in use. The strategy differs per browser, but essentially they launch the supported browsers with a self-signed certificate and a custom profile. No configuration changes needed for the browser, which is really nice.
owlbynight 5y ago
Price point on the personal account is too high over time. Would expect this to be a one time payment rather than a monthly fee for this type of software.
- spacephysics 5y ago
  One time payment? Surely being in this community you understand what maintenance and ongoing feature additions entail? The whole reason the software world turned to subscriptions is because one time payments don’t fit the model of continuous work. Now saying it should be just cheaper in general, or perhaps more tiers, sure.
  - johnchristopher 5y ago
    It used to be that it was expected/normal to pay for a new major version though (eg: Photoshop 4, 5, 5.5, 6).
    - qw 5y ago
      That has several drawbacks for a business: 1. Due to demands from marketing/sales, the supplier tends to increase versions for what is actually a minor feature, just to justify a new payment. 2. A subscription process is the most honest way of selling software. Jetbrains is a good example of this, where you get to keep your "fallback" version when you stop the subscription. 3. You often have to wait a long time for the next release, if you don't want to register in an "early access" program with versions that break constantly (basically providing free test resources). 4. You need to justify the new version to your boss, so that you can get it covered and start the approval process higher up in the hierarchy. 5. Approval processes in large Enterprises are often complex and time consuming. This not only applies to approving the payment, but often need to involve central IT. With a subscription model, this is only done once.
      - owlbynight 5y ago
        1. I don't know, maybe just don't be a piece of shit company. 2. JetBrains charges me $12 a month ($149 annually) for its entire suite of software. You think this tool by itself is worth $120 a year? For a personal license? 3. Developer's problem, not mine. 4. This is not an issue everywhere. You work with penny-pinching mongoloids. 5. This is not an issue everywhere. You work with penny-pinching mongoloids.
gatewaynode 5y ago
So like BURP Suite(https://portswigger.net/ https://portswigger.net/) but with fewer features?
- deleted 5y ago
  [deleted]
- sixothree 5y ago
  Maybe some user interface improvements?
Sytten 5y ago
We are in a similar space, our tool (https://caido.io https://caido.io) is geared toward bug bounty hunters and pentesters. HTTP Toolkit looks great congrats to the dev! It seems to compete more with requestly (https://requestly.io/ https://requestly.io/) than burp suite (https://portswigger.net/ https://portswigger.net/).
- TomAnthony 5y ago
  Excited about Caido! Been waiting on the beta list for a while!
  - Sytten 5y ago
    I dont want to hijack the thread but I will just say that we are going full time on it starting January so it will speed things up!
- jeffalo 5y ago
lux 5y ago
Curious if there's a tool in this category that does websockets well?
jmkni 5y ago
This is really really nice, I've actually been thinking about building something similar myself recently, thanks!!
thealistra 5y ago
I recommend https://paw.cloud https://paw.cloud for just the Postman clone - it has native UI, not an Electron shell. For doing proxies, there is https://proxyman.io https://proxyman.io, which I think is also native (haven't used it a lot, not sure)
- The_Colonel 5y ago
  > it has native UI, not an Electron shell. ... and as a result works only on Mac, so not usable for close to 90% of people. Every coin has 2 sides.
  - derrikcurran 5y ago
    Paw is cross-platform now.
    - The_Colonel 5y ago
      Nowhere on the website is Windows/Linux version mentioned/available for purchase.
      - derrikcurran 5y ago
        Yeah, it's a recent development and it may still be in beta. It's definitely a thing though. * https://blog.paw.cloud/paw-joins-forces-with-rapidapi/ https://blog.paw.cloud/paw-joins-forces-with-rapidapi/ * https://twitter.com/luckymarmot/status/1359541539161190401 https://twitter.com/luckymarmot/status/1359541539161190401
dneri 5y ago
This is really impressive. I've been using Charles for the last decade which performs the same actions but takes more work to set up, especially around the root certificate installation process. Will definitely be adding this to my toolkit!
- kingcharles 5y ago
  I was using Charles before I got locked up, which was before the Web went HTTPS everywhere. I tried using it the other day and had some real problems with the SSL setup. I ended up having to use Fiddler.
  - stjohnswarts 5y ago
    you got locked up? That's not something you hear on hacker news everyday, but something I often hear when I head home to see family during the holidays.
    - kingcharles 5y ago
      Yeesh. We both have a story there, it seems!
sn0wtrooper 5y ago
I liked this a lot. The easy ADB integration makes everything much faster to me.
rhtgrg 5y ago
It's fascinating how many of these tools exist. Some users have already posted similar tools in this thread, here's a YC backed one [0]. [0] https://www.ycombinator.com/companies/requestly https://www.ycombinator.com/companies/requestly
- zerkten 5y ago
  It's unfortunate that they often fail to give you anything that wasn't possible with Fiddler over 10 years ago. There is much potential for automating the things that folks are doing in these tools repeatedly, especially things that devs are doing for other stakeholders like support teams. Obviously security folks have an interest in these tools, but they generally understand the potential and exploit it more effectively than the generalists.
- cute_boi 5y ago
  httptoolkit is opensource and you can see contribute, look source code etc which is automatically superior to me.
- sachinjain024 5y ago
  Hey, This is Sachin - founder @ Requestly. At Requestly, We have solved primarily the problems of web developers often needing the capabilities to test local scripts in production (or staging environment), modifying headers, host scripts online. Even today, tools like Charles, Fiddler fail to solve simple use cases of Redirection, Headers, Simulating Delays, Scripts Injection in a simple user-friendly way. After all, developer experience also matters :-) Also, Setting up the desktop app vs the browser extension, the difference is way huge. It's way easier to work with browser extension when it comes to your intercept & modify browser traffic. As of Now, We have started to get requests to scale Requestly to other platforms to debug Mobile & Desktop app traffic too hence we have recently started to work on the desktop app (https://requestly.io/desktop https://requestly.io/desktop) (It's still in beta but usable). Here's a video a friend created sometime back - https://www.youtube.com/watch?v=LUqlA9j9Lx4&t=1s https://www.youtube.com/watch?v=LUqlA9j9Lx4&t=1s which explains how you can modify headers using Requestly desktop app. We'll try our best to solve the problems with Requestly that still exists in Charles, Fiddler and similar tools.
orliesaurus 5y ago
I am glad to see HTTP Toolkit back on HN: The author is an old friend who dedicated a lot of time and resources to make this tool and as someone who fiddled with it, it's a great alternative to Postman - which I used to love but now it's a little bit too heavy on pushing their marketing agenda. Also how on earth is Postman a $5.6 billion dollar company - I am super curious to see how much money Postman actually makes from enterprise sales - it must be a lot from the looks of that valuation.
- pleb_nz 5y ago
  Good to know. I might check this out. I used to enjoy postman, now I feel dirty when I use it. It used to be so simple and clean. Been thinking of looking for a new option for some time.
  - isuleman 5y ago
    Postwoman? aka Hoppscotch now.
- kyawzazaw 5y ago
  Two of my previous employers only used the free version, at least to my knowledge
  - flatiron 5y ago
    Their pricing is nutty to me. We have a share point folder at my job with a bunch of postman collections. Sure it would be nice to have that all built into postman but I think it’s $20 a month per employee. For that much just go on share point when you need to integrate with something. Crazy!
- lenkite 5y ago
  Does HTTP Toolkit provide support for OAuth modes (resource owner/client creds/etc) ? Does it provide support for client-cert calls ? Support for signing S3 requests ? A modern REST/HTTP UI client is expected to provide one or more of the above.
cute_boi 5y ago
I have used charles/proxyman/burp/figma and the best software I have used is httptoolkit. The opensource model of httptoolkit is praise worthy. And the maintainer is down to earth :). I am very delighted to use software like httptoolkit. The only issue with httptoolkit is electron but it isn't problem for me because I can always run it in browser <3.
e12e 5y ago
Looks very slick. As the author is active in this thread - why would I prefer this to mitmproxy? It seems to be missing from: https://httptoolkit.tech/alternatives/ https://httptoolkit.tech/alternatives/ I'd be interested both in why I'd prefer the open source httptoolkit and pro?
- svnpenn 5y ago
  MITM proxy doesnt include any builtin way to install a system certificate. So if whatever you are trying to monitor doesnt accept user certificate (which is most stuff), then MITM proxy wont even work: https://github.com/mitmproxy/mitmproxy/issues/4838 https://github.com/mitmproxy/mitmproxy/issues/4838
  - e12e 5y ago
    > So if whatever you are trying to monitor doesnt accept user certificate (which is most stuff), There's certainly examples that does not use openssl/gnutls (and compatible friends) - but it's a bit of a stretch to say most stuff doesn't support it? Most (all) Linux distros also have an easy way to add a system level cert, without messing with system managed certs. And AFAIK it's straightforward to install custom certs in the windows cert store as well. > MITM proxy doesnt include any builtin way to install a system certificate. Absolutely fair point of comparison. Most tls stacks will allow you to do this - via environment vars - so you can set a cert path for openssl when launching a ruby (or nodejs?) process, and things will just work. But you then need to know mitmproxy and your tls stack.
    - svnpenn 5y ago
      Most people I know use the tools for monitoring Android apps, so I think we are coming at this from completely different points of view.
- pimterry 5y ago
  > why would I prefer this to mitmproxy? Compared to mitmproxy, HTTP Toolkit: - Has fully automated setup for most browsers, docker containers, Android, all Node.js/Ruby/Python/PHP/Go applications run from intercepted terminal windows, all JVM processes, any Electron apps etc etc. Some of these automated setup steps are very difficult to do manually (e.g. intercepting Android devices, where you can't normally install your own certificates nowadays, or intercepting Node.js, which completely ignores system proxy settings) so this can make a huge difference in non-trivial case. - Supports targeted interception (intercept just one app/container/browser window) whilst all mitmproxy's manual setup steps are generally focused on helping you intercept your whole machine at once. Intercepting the whole machine means very noisy interception and means that rewriting traffic interferes with all other usage of your machine. Targeted interception means you can do neat things like run two HTTP Toolkit instances independently at the same time, and means you don't need root privileges or permanent configuration settings. - Has a VPN app for Android, which allows it to capture traffic even if it tries to ignore proxy configuration, means you don't have to manually edit and delete Android proxy settings, and which can automatically tunnel traffic over ADB connections, so you can intercept a device connected via ADB even if its not connectable over the wifi from your computer. - Has generally friendlier UI & UX (imo). For example, mitmproxy uses a unique custom syntax (https://docs.mitmproxy.org/stable/concepts-filters/ https://docs.mitmproxy.org/stable/concepts-filters/) of special characters to define matching & rewriting rules, or requires you to write a full python script. HTTP Toolkit lets you click 'new rule' -> 'GET requests' -> 'match regex <blah>' -> 'then reply with <blah>', and then immediately start injecting automated fake responses. From HTTP Toolkit you can then build named groups or these rules, and import & export them (as JSON) to build libraries you can share with your colleagues. - Provides lots more background information automatically: e.g. built-in documentation for all standard HTTP headers, body autoformatting for lots more formats, syntax highlighting, code folding, regex searching etc of request & response bodies, plus 'this is how and why this response could be cached' caching explanations, OpenAPI-powered docs for recognized endpoints on 1400+ APIs, etc. - Includes advanced features to do things like exporting requests as ready-to-use code for various languages & tools, or automatically testing the performance of different compression algorithms on a given response body. - Is more easily scriptable for automation & end-to-end testing, because all the HTTP-handling internals are usable as a standalone open-source JS library: https://github.com/httptoolkit/mockttp https://github.com/httptoolkit/mockttp That said, mitmproxy has been around longer, it's definitely more mature, and it was a big inspiration in many places. It's a great project! It does have some advantages of its own: - If you strongly prefer a CLI interface, mitmproxy is very focused on that, and HTTP Toolkit is not. HTTP Toolkit could support that too in theory (the backend & frontend are independent) but it definitely doesn't right now, and it's not high on my todo list (contributions welcome though!) - Mitmproxy is primarily scriptable in Python. You can build automation around HTTP Toolkit's internals using mockttp, but that's JS, and it's mostly usable standalone right now, rather than integrated into normal workflows within the app. If you want very complex scripted rules, mitmproxy has a few more options right now, and lets you do things in python instead of JS, which some people will prefer. - WebSocket debugging - this is coming for HTTP Toolkit soon, but it's not available today. WebSockets get passed through fine, but they don't appear in the UI, and you can't set up mock rules for them. > I'd be interested both in why I'd prefer the open source httptoolkit and pro? There's a list of Pro features at https://httptoolkit.tech/pricing/ https://httptoolkit.tech/pricing/. Note that it's all open source, even the Pro code, everything. The general idea is that everything you need to intercept, inspect and manually fiddle with traffic is totally free. Anything optional that most users don't need, but which is helpful for advanced usage or enterprise use cases, requires Pro.
santigr 5y ago
I code a small replacement for the postman mock servers and I see that only the pro version of http toolkit come with this feature. If you are interested in a simple and small replacement: https://github.com/sgrodriguez/yams https://github.com/sgrodriguez/yams
herpderperator 5y ago
Looks like it runs emulated via Rosetta 2. Would love to see an Apple Silicon version!
- gregoriol 5y ago
  Is there really a difference for such a simple app?
  - herpderperator 5y ago
    Absolutely. It's emulating Electron which is anything but simple. That being said, it should be fairly simple to recompile an Electron app into arm64.
deleted 5y ago
[deleted]
based2 5y ago
alt: https://mockoon.com/ https://mockoon.com/ https://github.com/mockoon/mockoon https://github.com/mockoon/mockoon
- mathfailure 5y ago
  And it's open-source!
the_arun 5y ago
I am looking for java library which logs metadata about any egress call (HTTP or others) from JVM. Do we have any?
zestyping 5y ago
I know it's probably a losing battle at this point, but — Would you consider using the more correct terminology "Fake" instead of "Mock"? In software testing, the two terms mean different things. A "fake" is a thing that takes the place of a service; you call it and it returns a fake result. A "mock" is a thing that enforces expectations of its caller; you specify a sequence of calls that you expect, then you run the caller and it verifies that the calls occurred in the manner and order expected. They are used for different purposes, and it's useful to have the clarity of two different terms for two different things. In particular, it is usually a better testing practice to use fakes instead of mocks. But now there are some testing libraries that create mocks (and call them mocks) and other testing libraries that create fakes (and also call them mocks), which has confused the issue and made it harder to speak clearly about a fairly important testing strategy decision. What HTTP Toolkit does is produce fake replies to HTTP requests. So "fake" is the best term for what it does, and thus I make this earnest plea to use that term to distinguish it from mocking, which it doesn't do.
- johnhenry 5y ago
  http://xunitpatterns.com/Test%20Double.html http://xunitpatterns.com/Test%20Double.html

538 points by hliyan 5y ago

I’ve been looking for an alternative to postman that isn’t so insanely geared to monetization. I feel postman compromises it’s entire UX to force a simple offline tool to be cloud based.

meibo 5y ago
I used to recommend https://insomnia.rest/ https://insomnia.rest/ as it was a free, sleek alternative... Alas it's been bought by Kong and enterprise'd up the same way. Not as bad yet, but can't be long.
- vladvasiliu 5y ago
  For the time being it's still OK. It asked me once to try the "premium" version or whatever it's called, I said no, and it never bothered me again. I don't know what licence Postman uses. A quick search on GitHub didn't turn up the source of the app on the Postman Labs page. Insomnia is MIT [0], so it could still be forked if Kong got decided to stop supporting the free version. [0] https://github.com/Kong/insomnia/blob/develop/LICENSE https://github.com/Kong/insomnia/blob/develop/LICENSE
  - chrisweekly 5y ago
    I still like Insomnia too.
  - meibo 5y ago
    I actually wasn't aware of it being open source at all, thanks. It's not mentioned anywhere on their page, gives me a bit more confidence :)
- pull_my_finger 5y ago
  Why would you think Kong would spoil it? Their main product is an API gateway, it makes sense to have a nice HTTP client under their umbrella. Kong is also open source and almost all of their plugins are freely available. I actually tried (and still use) Insomnia _because_ it was affiliated with Kong. YMMV but I've had no complaints about Insomnia at all.
- udfalkso 5y ago
  Insomnia is great, I use it daily. Highly reccommend.
- squeaky-clean 5y ago
  Am I having a Mandela Effect moment or did Insomnia used to be Mac only? I remember seeing it a long time ago and being disappointed I couldn't use it. Now I'm doubting my memory, lol. Either way thanks for the recommendation/reminder for Insomnia, it looks so much better than the current version of postman.
  - easton 5y ago
    You aren’t thinking of Paw, are you? https://paw.cloud/ https://paw.cloud/
  - phunehehe0 5y ago
    You are not alone! I just checked the Git history and it seems we were indeed mistaken, at least since 2017. It might have been just hard to see from the website. "Insomnia is available for Mac, Windows, and Linux and can be downloaded from http://insomnia.rest/download/ http://insomnia.rest/download/" https://github.com/Kong/insomnia/commit/23cca8c42b80aa6d9de23f0964f34258385afe76 https://github.com/Kong/insomnia/commit/23cca8c42b80aa6d9de2...
deleted 5y ago
[deleted]
thecopy 5y ago
I can recommend https://paw.cloud/ https://paw.cloud/ for MacOS
- mariusseufzer 5y ago
  I second this. It’s not open source, yes, but it’s a fair one-time payment. No subscription or anything!
  - BillinghamJ 5y ago
    They did shift to a subscription model for team use unfortunately: https://paw.cloud/pricing https://paw.cloud/pricing And were recently acquired, so likely to continue down that path: https://blog.paw.cloud/paw-joins-forces-with-rapidapi/ https://blog.paw.cloud/paw-joins-forces-with-rapidapi/ My previous company was an early & very heavy user of Paw - with thousands of endpoints in our project. Unfortunately at that scale, it has some major problems, particularly with syncing. A friend of mine has been working on https://getbeak.app https://getbeak.app to try and address those problems, but it's quite early stage still
    - haswell 5y ago
      I realize that certain UI patterns are going to inevitably overlap in this space, but this looks like a literal clone of Paw. Seems questionable.
      - jen20 5y ago
        It also does not solve the problem of subscription pricing - it's $25/year with no obvious one-time payment option.
gadrev 5y ago
For simple requests where it's just convenient to have them in a list, with a description/easy to find for replaying, a VSCode extension like Rest Client [0] can be useful instead of the desktop apps. Well, VSCode is a desktop app too, but if you already use it... :P I like it because you can just write a text file with the request and any comments you need around them, and... being just text, it's so easy to manipulate. When I need scripts for special auth I fall back to postman though, haven't digged enough to see if I can make it work with that addon (or any other one). Also there's Thunder Client [1] which I haven't tried but apparenly has more features. EDIT: references [0] https://github.com/Huachao/vscode-restclient https://github.com/Huachao/vscode-restclient [1] https://www.thunderclient.io/ https://www.thunderclient.io/
- vbezhenar 5y ago
  If you're using Intellij Idea, it supports similar http requests as well. Very convenient as those are just text files.
  - hdjrudni 5y ago
    IntelliJ rewrote this awhile back...used to be more GUI heavy. As much as I love text, it's harder to manipulate the GET vars now :\
- nine_k 5y ago
  Same thing is available for Emacs. I suspect that Vim, Sublime, or Notepad++ should likely already have a good equivalent of it, too.
  - dpipemazo 5y ago
    Sublime has requester which works quite well if you’re familiar with the Python requests syntax. You write the query in the equivalent Python line and then use some hotkeys to execute/send it. Variables can be used/stored in the file for common, verbose variables such as auth tokens. The response comes back in a new tab and it’s fairly easy to search through.
- 5y ago
ananthakumaran 5y ago
After having used postman for sometime, I realized it favors mouse click based workflow and is very resource heavy. I have switched to emacs verb[1] package and combined with some custom function for env (staging/local) management and org-roam for file management, it's much more comfortable to use. I don't have to learn a new set of shortcuts and can use all the other emacs features. [1]: https://github.com/federicotdn/verb https://github.com/federicotdn/verb
pletnes 5y ago
Monetization dark patterns is one thing. But how on earth do they lure people away from the good old plaintext-in-git workflow? I found everything about postman to be anti-git in nature, and then I lose versioning, CI/CD becomes weird, etc. I just don’t see the advantage for teams. If you’re a lone wolf developer who prefers a GUI - fine. But then, why pay up for the «pro» service?
- vladvasiliu 5y ago
  I've seen this used by people who are not quite devs but work with devs, as in not-really-technical PMs. They're happy to not have to deal with git, but they still need to see that some API replies with the expected result. They absolutely love postman.
  - pletnes 5y ago
    Sure thing, but why not keep the source in git, then distribute to end users, as we do with other software artifacts?
    - vladvasiliu 5y ago
      I may be mistaken since I'm not directly a part of this, but the way I understand this works is the other way around: it's the PMs who more or less come up with the API specs / explore upstream APIs, and it's also them who will do the querying. So they're the "first" as well as the "main" users of those collections. So basically, as they expect to be able to write their own requests and save / share them, they would have to either directly interact with git (which they'd rather avoid - at all) either have the "real devs" provide some kind of functionality similar to postman but backed by git. Needless to say, we're not in the business of developing a postman competitor, so devs have other things to do.
- squeaky-clean 5y ago
  In my experience, people aren't buying the pro version of Postman as solo/indie developers. Companies purchase it for their QA team, or for technical but non-developer roles that need to make requests, share them among teammates, and keep a cloud-sync'd collection of them.
dylanowen 5y ago
100% agree. After postman asked me to make an account I uninstalled it and have been building my own. It's not all wired together yet but I'm using this fork of https://github.com/dylanowen/dot-http/tree/wasm-library https://github.com/dylanowen/dot-http/tree/wasm-library I wanted something where I could store and share my requests over git instead of creating some random account. I also wanted the api description to be text not a UI+JSON blob. I also made this https://github.com/dylanowen/sublime-dot-http https://github.com/dylanowen/sublime-dot-http
adolph 5y ago
I don't think this is necessarily an alternative to Postman. It is more like an alternative to Fiddler or other mitm network traffic analysis tools oriented around 80/443 HTTP. The best alternative to Postman is curl coupled with jq and xmllint.
- wilmoore 5y ago
  If you like jq, then you might also like jmespath.terminal (jpterm): https://github.com/jmespath/jmespath.terminal https://github.com/jmespath/jmespath.terminal
aedocw 5y ago
I'm really surprised no one else has mentioned this so far, but Hoppscotch (formerly postwoman) is an excellent open alternative: https://github.com/hoppscotch/hoppscotch https://github.com/hoppscotch/hoppscotch
izyda 5y ago
How about HTTPie: https://httpie.io/ https://httpie.io/ Well known for the CLI, they now have a web/desktop client as well.
- the_arun 5y ago
  HTTPie is simple to use from command line. I use it for testing our apis.
vogre 5y ago
I use jupiter notebook. It allows writing and saving requests, in much more convenient(for me) way than postman does

ocdtrekkie 5y ago

I'm not sure if it's only because I'm on mobile, but the "enter your email to download" thing gives me weird marketing stuff vibes. I find it a weird touch on open source software I presumably can get without giving them my email.

IceWreck 5y ago
I tried it, it started the download and gave the enter email box at the same time. So its optional.
pimterry 5y ago
I'm the creator of HTTP Toolkit - you don't need to share your email to use it. It is a desktop app though, so you can't download it usefully on mobile. If you visit the landing page on mobile, it just offers to take your email address and send download links to your computer to get you started (and as an easy "bookmark this for later" option). That sends one follow up "Did you try it? Let me know what you think" email a week later, then it deletes your email, that's it. It's never shared elsewhere, it doesn't sign you up to the mailing list, there are no "great new offers", nada. Meanwhile, if you're on desktop it just shows a download button directly. After that starts it asks if you want to join the mailing list for updates, but you don't need to - the download starts immediately.
- cyberge99 5y ago
  This is exactly what should be noted. You’ll probably get more signups if people know how it’s going to be used.
- ocdtrekkie 5y ago
  I both understand the goal there, since indeed I can't meaningfully download it on mobile, but I would also point out many others will get the same vibes I noted above from it. Which is probably just to say after being burned too many times by bad actors, folks will start to group good actors in the same lot for similar patterns, even if the intent and design is better.

yolo3000 5y ago

How is this decrypting https out of the box, while with Charles proxy I needed to install a root certificate?

kevinbowman 5y ago
From a quick look at the code, it seems to be doing something similar, except it does it for you. Here's a link to the Firefox bit, where it makes a custom Firefox profile and then injects a certificate into it: https://github.com/httptoolkit/httptoolkit-server/blob/master/src/interceptors/fresh-firefox.ts#L220 https://github.com/httptoolkit/httptoolkit-server/blob/maste... I haven't seen the source for the .deb package, but in theory it could add a system cert at installation time. I don't know if it does, though.
- pimterry 5y ago
  I'm the author, that's exactly it! The contents of that interceptors folder should give you an idea how it all works: https://github.com/httptoolkit/httptoolkit-server/tree/master/src/interceptors https://github.com/httptoolkit/httptoolkit-server/tree/maste... It actually doesn't install system certificates at all though. It doesn't change any system configuration whatsoever, and it doesn't need any admin/root privileges. The deb package doesn't do anything different to any others. That's because the key differentiator of HTTP Toolkit vs Fiddler/Charles/mitmproxy etc, is that it provides targeted interception, rather than intercepting your entire system at once. That works by injecting cert & proxy config into a single browser window, intercepting specific Android apps, targeting individual Docker containers etc. That way you get much less noisy intercepted traffic for your debugging, and you can freely add rules to rewrite/break traffic without interfering with anything else. You can even open two HTTP Toolkit windows on one machine, and intercept things separately into each one. If you want, you can still do the normal steps to do full system interception manually if you'd prefer that, but by default it uses entirely transient and permissionless targeted interception instead, and that's almost always the better approach.
  - kevinbowman 5y ago

IceWreck 5y ago

a) This has less features than mitmproxy, burp suite or owasp zap. b) Export request is a very essential feature that's available for free in either of these alternatives and its pay-walled here. c) Intercept request in a terminal very badly broken. It broke (go get) and probably breaks others. I expect it adds an environment variable (which can be ignored by an application) or uses LD_PRELOAD (which doesn't work in statically linked applications). Other than that, it functions like you would expect it to. Worked out of the box for Firefox and curl.

pimterry 5y ago
I'm the author. I'm not a Go developer though, can you give me an example I can reproduce for `go get` that doesn't work for you? For the terminal, there's a few mechanisms, but environment variables are the catch-all there, yes (full list: https://github.com/httptoolkit/httptoolkit-server/blob/master/src/interceptors/terminal/terminal-env-overrides.ts https://github.com/httptoolkit/httptoolkit-server/blob/maste...). Those do work for most cases, but it is absolutely not a hard guarantee for applications that actively ignore standard proxy configuration (handling that is very hard, and definitely out of scope here). Go does generally observes `http_proxy` correctly by default in other cases I've tested, so this vert simple code from the test suite is automatically intercepted for example: https://github.com/httptoolkit/httptoolkit-server/blob/master/test/fixtures/docker/go/app.go https://github.com/httptoolkit/httptoolkit-server/blob/maste.... Very happy to look into any failing cases you can share.
- IceWreck 5y ago
  Yes, go based programs observe the proxy variable unless specifically compiled not to. But that doesn't break applications, they just ignore the env var. Go's default package manager doesn't seem to work at all with HTTP Toolkit. Here's what I did. * Intercept Tab > Fresh terminal. * In the terminal, do your usual stuff, it intercepts curl, etc. * If you try to use go's package manager, example: `go get golang.org/x/oauth2` It errors out with ``` go get: module golang.org/x/oauth2: reading http://127.0.0.1:8000/golang.org/x/oauth2/@v/list http://127.0.0.1:8000/golang.org/x/oauth2/@v/list: 500 Server error ``` Ideally it shouldn't break the application, just ignore if it can't intercept. > absolutely not a hard guarantee for applications that actively ignore standard proxy configuration (handling that is very hard, and definitely out of scope here). I encountered a usecase where this was needed and LD_PRELOAD trick (used by proxychains) etc failed because the application was statically compiled. I ended up using https://github.com/hmgle/graftcp https://github.com/hmgle/graftcp which somehow manages to force tcp traffic through a socks5 proxy.

can16358p 5y ago

This would be great but it doesn't have the only features I truly need: intercepting HTTPS connections from iOS apps. I understand that intercepting HTTPS might be a bit complicated for iOS and still think this is a great project though!

s_dev 5y ago
Maybe you need something like Charles Proxy or Proxyman?
- can16358p 5y ago
  Yeah, but a streamlined "just works" setup would be much more useful (which the project really aims on). Otherwise, yeah it's possible, but again, it has always been possible with more complicated (compared to this) tools anyway.
kevinbowman 5y ago
I think Charles proxy can do that, by installing itself as a VPN on iOS devices and also as a device configuration profile (so it can use a custom CA to MITM the traffic).
pimterry 5y ago
I'm the author. Yes, I'm afraid automatic iOS interception isn't available yet, but it's definitely planned for the future! You can subscribe to the GitHub issue here for updates: https://github.com/httptoolkit/httptoolkit/issues/11 https://github.com/httptoolkit/httptoolkit/issues/11 In the meantime it's still totally possible to intercept iOS devices, but you just have to do the initial setup manually unfortunately.
- can16358p 5y ago
  Lovely! Looking forward for a automated-iOS setup (at least as much as the walled garden" permits). Keep up the good work!

FreeHugs 5y ago

It would be cool if something like this would be possible with standard Linux tools on the command line. How hard would it be to implement a network rule "if http://abc.com/def http://abc.com/def is requested reply with this data: ..."? Or is it possible to inject something like this on the fly into Apache? Would be very nice to mock end-2-end tests.

marcosdumay 5y ago
I'm not sure what you are expecting that isn't a main feature of Apache. I imagine you expect something like a CGI script with mod-rewrite, but your comment only actually requires plain Apache. A network rule of "if URL is requested reply with this data" is implemented by putting a file at the expected place.
- dotancohen 5y ago
  > only actually requires plain Apache ... and a hosts file entry. Still, trivial for any machine that the operator administers.
cedricvanrompay 5y ago
Note that HTTPS, unlike says VPNs (IPSec, Wireguard...), provides authenticity protection up to the application itself. If the kernel sends a modified packet to the application, it will be rejected by the application. As a result, to implement HTTPS interception / rewrite / injection you need some degree of modification of the application itself. The "minimal" way is to add a new TLS certificate to the certificate trust store the application uses that is marked as "allowed for every domain" (that's what Burp suite does). It seems that HTTP toolkit does it differently for the browsers it supports, probably a plugin/extension added to the browser that alters the traffic after the TLS block (HTTPS is HTTP over TLS)
- cjcampbell 5y ago
  No plug-in or extension. I dug in when I first learned about it because I wanted to make sure I understood how it would impact browser security when it was not in use. The strategy differs per browser, but essentially they launch the supported browsers with a self-signed certificate and a custom profile. No configuration changes needed for the browser, which is really nice.

owlbynight 5y ago

Price point on the personal account is too high over time. Would expect this to be a one time payment rather than a monthly fee for this type of software.

spacephysics 5y ago
One time payment? Surely being in this community you understand what maintenance and ongoing feature additions entail? The whole reason the software world turned to subscriptions is because one time payments don’t fit the model of continuous work. Now saying it should be just cheaper in general, or perhaps more tiers, sure.
- johnchristopher 5y ago
  It used to be that it was expected/normal to pay for a new major version though (eg: Photoshop 4, 5, 5.5, 6).
  - qw 5y ago
    That has several drawbacks for a business: 1. Due to demands from marketing/sales, the supplier tends to increase versions for what is actually a minor feature, just to justify a new payment. 2. A subscription process is the most honest way of selling software. Jetbrains is a good example of this, where you get to keep your "fallback" version when you stop the subscription. 3. You often have to wait a long time for the next release, if you don't want to register in an "early access" program with versions that break constantly (basically providing free test resources). 4. You need to justify the new version to your boss, so that you can get it covered and start the approval process higher up in the hierarchy. 5. Approval processes in large Enterprises are often complex and time consuming. This not only applies to approving the payment, but often need to involve central IT. With a subscription model, this is only done once.
    - owlbynight 5y ago
      1. I don't know, maybe just don't be a piece of shit company. 2. JetBrains charges me $12 a month ($149 annually) for its entire suite of software. You think this tool by itself is worth $120 a year? For a personal license? 3. Developer's problem, not mine. 4. This is not an issue everywhere. You work with penny-pinching mongoloids. 5. This is not an issue everywhere. You work with penny-pinching mongoloids.

gatewaynode 5y ago

So like BURP Suite(https://portswigger.net/ https://portswigger.net/) but with fewer features?

deleted 5y ago
[deleted]
sixothree 5y ago
Maybe some user interface improvements?

Sytten 5y ago

We are in a similar space, our tool (https://caido.io https://caido.io) is geared toward bug bounty hunters and pentesters. HTTP Toolkit looks great congrats to the dev! It seems to compete more with requestly (https://requestly.io/ https://requestly.io/) than burp suite (https://portswigger.net/ https://portswigger.net/).

TomAnthony 5y ago
Excited about Caido! Been waiting on the beta list for a while!
- Sytten 5y ago
  I dont want to hijack the thread but I will just say that we are going full time on it starting January so it will speed things up!
jeffalo 5y ago

lux 5y ago

Curious if there's a tool in this category that does websockets well?

jmkni 5y ago

This is really really nice, I've actually been thinking about building something similar myself recently, thanks!!

thealistra 5y ago

I recommend https://paw.cloud https://paw.cloud for just the Postman clone - it has native UI, not an Electron shell. For doing proxies, there is https://proxyman.io https://proxyman.io, which I think is also native (haven't used it a lot, not sure)

The_Colonel 5y ago
> it has native UI, not an Electron shell. ... and as a result works only on Mac, so not usable for close to 90% of people. Every coin has 2 sides.
- derrikcurran 5y ago
  Paw is cross-platform now.
  - The_Colonel 5y ago
    Nowhere on the website is Windows/Linux version mentioned/available for purchase.
    - derrikcurran 5y ago
      Yeah, it's a recent development and it may still be in beta. It's definitely a thing though. * https://blog.paw.cloud/paw-joins-forces-with-rapidapi/ https://blog.paw.cloud/paw-joins-forces-with-rapidapi/ * https://twitter.com/luckymarmot/status/1359541539161190401 https://twitter.com/luckymarmot/status/1359541539161190401

dneri 5y ago

This is really impressive. I've been using Charles for the last decade which performs the same actions but takes more work to set up, especially around the root certificate installation process. Will definitely be adding this to my toolkit!

kingcharles 5y ago
I was using Charles before I got locked up, which was before the Web went HTTPS everywhere. I tried using it the other day and had some real problems with the SSL setup. I ended up having to use Fiddler.
- stjohnswarts 5y ago
  you got locked up? That's not something you hear on hacker news everyday, but something I often hear when I head home to see family during the holidays.
  - kingcharles 5y ago
    Yeesh. We both have a story there, it seems!

sn0wtrooper 5y ago

I liked this a lot. The easy ADB integration makes everything much faster to me.

rhtgrg 5y ago

It's fascinating how many of these tools exist. Some users have already posted similar tools in this thread, here's a YC backed one [0]. [0] https://www.ycombinator.com/companies/requestly https://www.ycombinator.com/companies/requestly

zerkten 5y ago
It's unfortunate that they often fail to give you anything that wasn't possible with Fiddler over 10 years ago. There is much potential for automating the things that folks are doing in these tools repeatedly, especially things that devs are doing for other stakeholders like support teams. Obviously security folks have an interest in these tools, but they generally understand the potential and exploit it more effectively than the generalists.
cute_boi 5y ago
httptoolkit is opensource and you can see contribute, look source code etc which is automatically superior to me.
sachinjain024 5y ago
Hey, This is Sachin - founder @ Requestly. At Requestly, We have solved primarily the problems of web developers often needing the capabilities to test local scripts in production (or staging environment), modifying headers, host scripts online. Even today, tools like Charles, Fiddler fail to solve simple use cases of Redirection, Headers, Simulating Delays, Scripts Injection in a simple user-friendly way. After all, developer experience also matters :-) Also, Setting up the desktop app vs the browser extension, the difference is way huge. It's way easier to work with browser extension when it comes to your intercept & modify browser traffic. As of Now, We have started to get requests to scale Requestly to other platforms to debug Mobile & Desktop app traffic too hence we have recently started to work on the desktop app (https://requestly.io/desktop https://requestly.io/desktop) (It's still in beta but usable). Here's a video a friend created sometime back - https://www.youtube.com/watch?v=LUqlA9j9Lx4&t=1s https://www.youtube.com/watch?v=LUqlA9j9Lx4&t=1s which explains how you can modify headers using Requestly desktop app. We'll try our best to solve the problems with Requestly that still exists in Charles, Fiddler and similar tools.

orliesaurus 5y ago

I am glad to see HTTP Toolkit back on HN: The author is an old friend who dedicated a lot of time and resources to make this tool and as someone who fiddled with it, it's a great alternative to Postman - which I used to love but now it's a little bit too heavy on pushing their marketing agenda. Also how on earth is Postman a $5.6 billion dollar company - I am super curious to see how much money Postman actually makes from enterprise sales - it must be a lot from the looks of that valuation.

pleb_nz 5y ago
Good to know. I might check this out. I used to enjoy postman, now I feel dirty when I use it. It used to be so simple and clean. Been thinking of looking for a new option for some time.
- isuleman 5y ago
  Postwoman? aka Hoppscotch now.
kyawzazaw 5y ago
Two of my previous employers only used the free version, at least to my knowledge
- flatiron 5y ago
  Their pricing is nutty to me. We have a share point folder at my job with a bunch of postman collections. Sure it would be nice to have that all built into postman but I think it’s $20 a month per employee. For that much just go on share point when you need to integrate with something. Crazy!
lenkite 5y ago
Does HTTP Toolkit provide support for OAuth modes (resource owner/client creds/etc) ? Does it provide support for client-cert calls ? Support for signing S3 requests ? A modern REST/HTTP UI client is expected to provide one or more of the above.

cute_boi 5y ago

I have used charles/proxyman/burp/figma and the best software I have used is httptoolkit. The opensource model of httptoolkit is praise worthy. And the maintainer is down to earth :). I am very delighted to use software like httptoolkit. The only issue with httptoolkit is electron but it isn't problem for me because I can always run it in browser <3.

e12e 5y ago

Looks very slick. As the author is active in this thread - why would I prefer this to mitmproxy? It seems to be missing from: https://httptoolkit.tech/alternatives/ https://httptoolkit.tech/alternatives/ I'd be interested both in why I'd prefer the open source httptoolkit and pro?

svnpenn 5y ago
MITM proxy doesnt include any builtin way to install a system certificate. So if whatever you are trying to monitor doesnt accept user certificate (which is most stuff), then MITM proxy wont even work: https://github.com/mitmproxy/mitmproxy/issues/4838 https://github.com/mitmproxy/mitmproxy/issues/4838
- e12e 5y ago
  > So if whatever you are trying to monitor doesnt accept user certificate (which is most stuff), There's certainly examples that does not use openssl/gnutls (and compatible friends) - but it's a bit of a stretch to say most stuff doesn't support it? Most (all) Linux distros also have an easy way to add a system level cert, without messing with system managed certs. And AFAIK it's straightforward to install custom certs in the windows cert store as well. > MITM proxy doesnt include any builtin way to install a system certificate. Absolutely fair point of comparison. Most tls stacks will allow you to do this - via environment vars - so you can set a cert path for openssl when launching a ruby (or nodejs?) process, and things will just work. But you then need to know mitmproxy and your tls stack.
  - svnpenn 5y ago
    Most people I know use the tools for monitoring Android apps, so I think we are coming at this from completely different points of view.
pimterry 5y ago
> why would I prefer this to mitmproxy? Compared to mitmproxy, HTTP Toolkit: - Has fully automated setup for most browsers, docker containers, Android, all Node.js/Ruby/Python/PHP/Go applications run from intercepted terminal windows, all JVM processes, any Electron apps etc etc. Some of these automated setup steps are very difficult to do manually (e.g. intercepting Android devices, where you can't normally install your own certificates nowadays, or intercepting Node.js, which completely ignores system proxy settings) so this can make a huge difference in non-trivial case. - Supports targeted interception (intercept just one app/container/browser window) whilst all mitmproxy's manual setup steps are generally focused on helping you intercept your whole machine at once. Intercepting the whole machine means very noisy interception and means that rewriting traffic interferes with all other usage of your machine. Targeted interception means you can do neat things like run two HTTP Toolkit instances independently at the same time, and means you don't need root privileges or permanent configuration settings. - Has a VPN app for Android, which allows it to capture traffic even if it tries to ignore proxy configuration, means you don't have to manually edit and delete Android proxy settings, and which can automatically tunnel traffic over ADB connections, so you can intercept a device connected via ADB even if its not connectable over the wifi from your computer. - Has generally friendlier UI & UX (imo). For example, mitmproxy uses a unique custom syntax (https://docs.mitmproxy.org/stable/concepts-filters/ https://docs.mitmproxy.org/stable/concepts-filters/) of special characters to define matching & rewriting rules, or requires you to write a full python script. HTTP Toolkit lets you click 'new rule' -> 'GET requests' -> 'match regex <blah>' -> 'then reply with <blah>', and then immediately start injecting automated fake responses. From HTTP Toolkit you can then build named groups or these rules, and import & export them (as JSON) to build libraries you can share with your colleagues. - Provides lots more background information automatically: e.g. built-in documentation for all standard HTTP headers, body autoformatting for lots more formats, syntax highlighting, code folding, regex searching etc of request & response bodies, plus 'this is how and why this response could be cached' caching explanations, OpenAPI-powered docs for recognized endpoints on 1400+ APIs, etc. - Includes advanced features to do things like exporting requests as ready-to-use code for various languages & tools, or automatically testing the performance of different compression algorithms on a given response body. - Is more easily scriptable for automation & end-to-end testing, because all the HTTP-handling internals are usable as a standalone open-source JS library: https://github.com/httptoolkit/mockttp https://github.com/httptoolkit/mockttp That said, mitmproxy has been around longer, it's definitely more mature, and it was a big inspiration in many places. It's a great project! It does have some advantages of its own: - If you strongly prefer a CLI interface, mitmproxy is very focused on that, and HTTP Toolkit is not. HTTP Toolkit could support that too in theory (the backend & frontend are independent) but it definitely doesn't right now, and it's not high on my todo list (contributions welcome though!) - Mitmproxy is primarily scriptable in Python. You can build automation around HTTP Toolkit's internals using mockttp, but that's JS, and it's mostly usable standalone right now, rather than integrated into normal workflows within the app. If you want very complex scripted rules, mitmproxy has a few more options right now, and lets you do things in python instead of JS, which some people will prefer. - WebSocket debugging - this is coming for HTTP Toolkit soon, but it's not available today. WebSockets get passed through fine, but they don't appear in the UI, and you can't set up mock rules for them. > I'd be interested both in why I'd prefer the open source httptoolkit and pro? There's a list of Pro features at https://httptoolkit.tech/pricing/ https://httptoolkit.tech/pricing/. Note that it's all open source, even the Pro code, everything. The general idea is that everything you need to intercept, inspect and manually fiddle with traffic is totally free. Anything optional that most users don't need, but which is helpful for advanced usage or enterprise use cases, requires Pro.

santigr 5y ago

I code a small replacement for the postman mock servers and I see that only the pro version of http toolkit come with this feature. If you are interested in a simple and small replacement: https://github.com/sgrodriguez/yams https://github.com/sgrodriguez/yams

herpderperator 5y ago

Looks like it runs emulated via Rosetta 2. Would love to see an Apple Silicon version!

gregoriol 5y ago
Is there really a difference for such a simple app?
- herpderperator 5y ago
  Absolutely. It's emulating Electron which is anything but simple. That being said, it should be fairly simple to recompile an Electron app into arm64.

deleted 5y ago

[deleted]

based2 5y ago

alt: https://mockoon.com/ https://mockoon.com/ https://github.com/mockoon/mockoon https://github.com/mockoon/mockoon

mathfailure 5y ago
And it's open-source!

the_arun 5y ago

I am looking for java library which logs metadata about any egress call (HTTP or others) from JVM. Do we have any?

zestyping 5y ago

I know it's probably a losing battle at this point, but — Would you consider using the more correct terminology "Fake" instead of "Mock"? In software testing, the two terms mean different things. A "fake" is a thing that takes the place of a service; you call it and it returns a fake result. A "mock" is a thing that enforces expectations of its caller; you specify a sequence of calls that you expect, then you run the caller and it verifies that the calls occurred in the manner and order expected. They are used for different purposes, and it's useful to have the clarity of two different terms for two different things. In particular, it is usually a better testing practice to use fakes instead of mocks. But now there are some testing libraries that create mocks (and call them mocks) and other testing libraries that create fakes (and also call them mocks), which has confused the issue and made it harder to speak clearly about a fairly important testing strategy decision. What HTTP Toolkit does is produce fake replies to HTTP requests. So "fake" is the best term for what it does, and thus I make this earnest plea to use that term to distinguish it from mocking, which it doesn't do.

johnhenry 5y ago
http://xunitpatterns.com/Test%20Double.html http://xunitpatterns.com/Test%20Double.html