|
|
|
|
|
|
by kevinbowman
1637 days ago
|
|
|
From a quick look at the code, it seems to be doing something similar, except it does it for you. Here's a link to the Firefox bit, where it makes a custom Firefox profile and then injects a certificate into it: https://github.com/httptoolkit/httptoolkit-server/blob/maste... I haven't seen the source for the .deb package, but in theory it could add a system cert at installation time. I don't know if it does, though. |
|
|
It actually doesn't install system certificates at all though. It doesn't change any system configuration whatsoever, and it doesn't need any admin/root privileges. The deb package doesn't do anything different to any others.
That's because the key differentiator of HTTP Toolkit vs Fiddler/Charles/mitmproxy etc, is that it provides targeted interception, rather than intercepting your entire system at once.
That works by injecting cert & proxy config into a single browser window, intercepting specific Android apps, targeting individual Docker containers etc. That way you get much less noisy intercepted traffic for your debugging, and you can freely add rules to rewrite/break traffic without interfering with anything else.
You can even open two HTTP Toolkit windows on one machine, and intercept things separately into each one.
If you want, you can still do the normal steps to do full system interception manually if you'd prefer that, but by default it uses entirely transient and permissionless targeted interception instead, and that's almost always the better approach.