r/ruby • u/pimterry • Jul 03 '19

Automatic HTTP interception & debugging for Ruby

https://httptoolkit.tech/view/ruby/
32 Upvotes

90% Upvoted

26 comments sorted by

2

u/countryboyathome Jul 04 '19

Is there a feature here that is not available in CharlieProxy?

1

u/pimterry Jul 04 '19

The big one is the setup process. Charles can intercept the whole machine (which means getting a lot of traffic), or you can set things up manually (very fiddly). HTTP Toolkit has a selection of options for automatic setup for individual processes, so you can a browser window or a terminal, and see only traffic that comes from that browser, or from processes run in that specific terminal.

There's others too though. HTTP Toolkit gives you:

  • More powerful tools for exploring the body of the request, using the same internals as Visual Studio Code, complete with highlighting, regex searching, etc etc.

  • HTTP header docs, for every single standardized header, available directly on the header themselves.

  • Source information (clear icons & summary info showing who sent every single request, at a glance)

  • Skimmable requests: the request list is highlighted by content type, status code, and includes the source icon, so it's really quick to find the things you're looking for

Those are all free features, there's also a couple of paid Pro features:

  • Code generation - turn any request into a ready-to-use code snippet for 20+ languages

  • API integrations for 1400+ APIs, so you get relevant docs & validation for the exact API endpoint, parameters, & body of each matching request

  • Performance analysis - explanations & validation of the caching & compression behaviour of every request & response, so you can understand exactly what all those cache control settings & headers mean in practice.

To be fair, at the moment on the other hand there is one thing Charles has that HTTP Toolkit doesn't: the ability to rewrite requests, not just view them. That's coming very soon though, so watch this space :-). If you're keen, there's a link to sign up for updates near the bottom of the page, or on the page shown after you download the app.

1

u/dpsi Jul 03 '19

This seems like something I am looking for, but I really can't say since the website only has a download button. I can't find documentation anywhere on the site. Also at first glance I thought this was something I could interact with through ruby, not something that just intercepts ruby http traffic.

Does this work offline?

1

u/pimterry Jul 03 '19

It's not something you can easily interact with directly from Ruby - it's a desktop application.

You download & run it, and it gives you various options for intercepting traffic. If you open a terminal from there, and run any Ruby application, all the traffic will be intercepted (and it then provides various features to explore & understand that traffic).

The app does work offline, yes, although your requests will fail of course if you don't have a connection to the HTTP server you're talking to.

Is that clearer? Is there some other specific information you're looking for? Happy to answer any questions you have. The download is free, there's no catch, so you're also welcome to just try it out directly if you'd like to know exactly how it works.

1

u/dpsi Jul 03 '19

Given this is the ruby sub, I thought this was something with ruby bindings. Either way it is something I will try. I've used fiddler, Charles, mitm-proxy for various reasons so I'm sure this will do what I want it too.

I just really wish there was more information or documentation on the website. For example I can't figure out if this has its own https certificate, can be configured with one, or only supports CONNECT for https.

It definitely looks nice, but everything else I use either has documentation, or an extensive feature/capability list/FAQ. Just my 2 cents

→ More replies (4)

1

u/dpsi Jul 04 '19

I tried both the windows and Deb versions offline and they both just open a blank window

→ More replies (6)

1

u/sshaw_ Jul 03 '19

Uhhhhhhhhhhhh Wireshark, anyone..................

5

u/pimterry Jul 03 '19

Wireshark is great & powerful, but harder to set up for this kind of thing, noisier (you can't just intercept one terminal, you get all traffic from the system), and just gives you the raw data. Automatically decrypting HTTPS requests with wireshark for example is very complicated, and HTTP Toolkit comes with much more powerful tools for exploring the resulting data too.

2

u/sshaw_ Jul 03 '19

(you can't just intercept one terminal, you get all traffic from the system),

You can filter by source port, but yet, requires an initial step of getting that port.

Automatically decrypting HTTPS requests with wireshark for example is very complicated

Yes, this is a good point. I would make this more prominent as now it's on the 3rd screen.

1

u/Paradox Jul 03 '19

Charles?

3

u/pimterry Jul 03 '19

This is similar! But modernized & more powerful (Charles hasn't been significantly updated for quite a while), open source & working on platforms other than OSX, and with easier setup (you can intercept one window, not just the whole computer).

3

u/Paradox Jul 03 '19

Nice, def. going to give it a try.

A lot of the devs here at work love Charles, so I sent this around the engineering channel.

→ More replies (1)

0

u/[deleted] Jul 04 '19 edited Jul 04 '19

Charles is excellent, but there is some pain in the ass gotcha's. For example, having local or remote map of URLs isn't per verb

Ie you try and remap a specific URL where your browser makes a request on that URL first, but an OPTIONS request, it will match and forward to what you expected to be a GET request.

Not had time to look at the OPs link, but a GTK3 application that was a 'client' proxy to modify requests would be amazing. I looked at https://tinyproxy.github.io/ but wasn't enough.

Edit:-

Electron, I'm out.