Hacker News Reader

Have you ever tried HTTP Toolkit? See https://httptoolkit.tech/ (disclaimer: I'm the author)

It quite a few features on top of the core MITM functionality, like automated setup for a bunch of use cases like browsers & Android interception (not Docker, yet, but it's coming!). If you're an avid mitmproxy user I'd love to know what you think.

View on HN

Very cool. I'll check it out! It does look easier to setup. Does it work the same way? By adding a trusted CA into the keychain list?

The docker use-case is tricky, as images are immutable so you have to basically create a new image with the cert in place.

Sort of: it generates a certificate, and you _can_ add it to the keychain just like mitmproxy etc, but by default it avoids doing that, because you don't need to globally trust the CA cert for most use cases, and avoiding doing so if you can is nice for security (more details: https://httptoolkit.tech/blog/debugging-https-without-global...).

Instead, it injects the certificate & proxy settings manually into intercepted targets as it launches them. So you can intercept a single Chrome window or all processes launched from a single terminal window without affecting any of the rest of your system.

Interesting! I can see why that might be a better model for the places it can work.

Reply on news.ycombinator.com