Intercepting the whole machine means very noisy interception and means that rewriting traffic interferes with all other usage of your machine.
HTTP TOOLKIT PRO MANUAL
Supports targeted interception (intercept just one app/container/browser window) whilst all mitmproxy's manual setup steps are generally focused on helping you intercept your whole machine at once.
HTTP TOOLKIT PRO INSTALL
intercepting Android devices, where you can't normally install your own certificates nowadays, or intercepting Node.js, which completely ignores system proxy settings) so this can make a huge difference in non-trivial case. Some of these automated setup steps are very difficult to do manually (e.g. Has fully automated setup for most browsers, docker containers, Android, all Node.js/Ruby/Python/PHP/Go applications run from intercepted terminal windows, all JVM processes, any Electron apps etc etc.
So "fake" is the best term for what it does, and thus I make this earnest plea to use that term to distinguish it from mocking, which it doesn't do. What HTTP Toolkit does is produce fake replies to HTTP requests. But now there are some testing libraries that create mocks (and call them mocks) and other testing libraries that create fakes (and also call them mocks), which has confused the issue and made it harder to speak clearly about a fairly important testing strategy decision. In particular, it is usually a better testing practice to use fakes instead of mocks. They are used for different purposes, and it's useful to have the clarity of two different terms for two different things. A "mock" is a thing that enforces expectations of its caller you specify a sequence of calls that you expect, then you run the caller and it verifies that the calls occurred in the manner and order expected. A "fake" is a thing that takes the place of a service you call it and it returns a fake result. In software testing, the two terms mean different things. Would you consider using the more correct terminology "Fake" instead of "Mock"? I know it's probably a losing battle at this point, but.
HTTP TOOLKIT PRO FULL
If you want, you can still do the normal steps to do full system interception manually if you'd prefer that, but by default it uses entirely transient and permissionless targeted interception instead, and that's almost always the better approach. You can even open two HTTP Toolkit windows on one machine, and intercept things separately into each one. That way you get much less noisy intercepted traffic for your debugging, and you can freely add rules to rewrite/break traffic without interfering with anything else. That works by injecting cert & proxy config into a single browser window, intercepting specific Android apps, targeting individual Docker containers etc. That's because the key differentiator of HTTP Toolkit vs Fiddler/Charles/mitmproxy etc, is that it provides targeted interception, rather than intercepting your entire system at once. The deb package doesn't do anything different to any others. It doesn't change any system configuration whatsoever, and it doesn't need any admin/root privileges. It actually doesn't install system certificates at all though. I'm the author, that's exactly it! The contents of that interceptors folder should give you an idea how it all works.
0 kommentar(er)
