Top all-time · #1181
HTTP Toolkit
Company blog · httptoolkit.com/blog · on HN as pimterrywebprogrammingsecurity
HTTP Toolkit is the company blog at httptoolkit.com, writing about web, programming and security. Since 2022, 58 different Hacker News readers have linked it 100 times, most often “Apple already shipped attestation on the web, and we barely noticed”. It is still writing: the last post was on 2026-09-23, and you can follow it by feed.
Beautiful, cross-platform & open-source tools for debugging, testing and building with HTTP(S), on Windows, Linux & Mac.
Most-linked posts?
- Apple already shipped attestation on the web, and we barely noticed19 people · 20 mentions · first linked 2023-07-25
- Security and privacy risks of public JavaScript CDNs8 people · 10 mentions · first linked 2023-01-04
- HTTP Toolkit6 people · 6 mentions · first linked 2023-01-12
- How to own your own Docker Registry address5 people · 5 mentions · first linked 2023-03-17
- /4 people · 5 mentions · first linked 2023-04-14
- HTTP/3 is everywhere but nowhere4 people · 5 mentions · first linked 2025-03-12
- /blog/frida-certificate-pinning/4 people · 4 mentions · first linked 2023-04-14
- What is X-Forwarded-For and when can you trust it? (2024)4 people · 4 mentions · first linked 2024-01-31
- EU Funding for Mobile App Traffic Interception2 people · 3 mentions · first linked 2023-02-27
- New ways to inject system CA certificates in Android 142 people · 3 mentions · first linked 2023-09-21
What Hacker News says?
Even if the web developed effective single sign-on payment solutions, it would make utterly no difference for iOS, since Safari would never support the same. You can easily bet your life, that Apple would reject this or only maliciously comply. https://httptoolkit.com/blog/safari-is-killing-the-web/
Comment linking /blog/safari-is-killing-the-web/
on “Apple's requirements are about to hit creators and fans on Patreon”Submitted HTTP/3 is everywhere but nowhere as a story · 424 points
HN discussion> this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io I've said it before, and I'll say it again: https://httptoolkit.com/blog/public-cdn-risks/ You can reduce issues like this using subresource intergrity (SRI) but there are still tradeoffs (around privacy & reliability - see article above) and there is a better solution: self-host your dependencies behind a CDN servi…
Comment linking /blog/public-cdn-risks/
on “Polyfill supply chain attack hits 100K+ sites”Submitted Security and privacy risks of public JavaScript CDNs as a story · 131 points
HN discussionIf you want to RE some android apps HTTP or even HTTPS, it's more straight-forward to use httptoolkit and frida. Might be a bit rough the first time you do it, but once its set up its a breeze. You can intercept calls and even modify etc https://httptoolkit.com/blog/frida-certificate-pinning/ https://github.com/httptoolkit/frida-interception-and-unpinn...
Comment linking /blog/frida-certificate-pinning/
on “All the data can be yours: reverse engineering APIs”Submitted Android 14 blocks all modification of system certificates, even as root as a story · 79 points
HN discussionThere's also certificate pinning which is done by basically every modern android app so you often need to modify apk to remove that. Httptoolkit has a good blog on the process: https://httptoolkit.com/blog/frida-certificate-pinning/
Comment linking /blog/frida-certificate-pinning/
on “Waydroid – Android in a Linux container”Submitted What is X-Forwarded-For and when can you trust it? (2024) as a story · 66 points
HN discussionAnd from Android 14 - adding a system CA certificate is a nightmare: https://httptoolkit.com/blog/android-14-install-system-ca-ce...
Comment linking /blog/android-14-install-system-ca-certificate/
on “Cracking Meta's Messenger Certificate Pinning on macOS”Submitted Apple already shipped attestation on the web, and we barely noticed as a story · 54 points
HN discussion> The alternative to CDNs is to use npm and have a build step for your projects. I find this reduces my productivity at hacking on individual tools and makes it harder to self-host them. No. You can vendor these scripts & host them 1st party so you aren’t leaking data to these CDNs or risk users not actually getting the scripts. It isn’t like CDNs give you a performance boost anymore. https://httptoolkit.com/blog/pu…
Comment linking /blog/public-cdn-risks/
on “Useful patterns for building HTML tools”Submitted How to intercept, observe and mock WebRTC traffic as a story · 28 points
HN discussionFor my rather simple needs I've been using https://httptoolkit.com free edition, I like that it launches a independent Firefox window on its own for the intercepting so I don't have to touch my working browser or deal with configuring a proxy anywhere
Comment linking /
on “Charles Proxy”Submitted Httpwtf? (2021) as a story · 19 points
HN discussionThis one is truly a gem: https://httptoolkit.com It even bypasses SSL pinning on Android using 1 click.
Comment linking /
on “Charles Proxy”Submitted How to own your own Docker Registry address as a story · 13 points
HN discussionNot only. Example: Chrome on Android did change some time ago so if CA is in System store (which means it got here from manufacturer or from user which does have root access) - such CA MUST use Certificate Transparency. This rule doesn't apply if CA is in User store (installable by regular user) - https://httptoolkit.com/blog/chrome-android-certificate-tran... Another example: Yandex Browser ONLY trust Russian NUC c…
Comment linking /blog/chrome-android-certificate-transparency/
on “Entrust Certificate Distrust”Submitted HTTP/3 is everywhere but nowhere as a story · 8 points
HN discussionJust setup httptoolkit [0], it just works. [0] - https://httptoolkit.com/
Comment linking /
on “Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs”Submitted HTTP/3 is everywhere but nowhere as a story · 7 points
HN discussionHave a look at https://httptoolkit.com/ which works with a lot tools (even cli)
Comment linking /
on “Show HN: Httpdbg – A tool to trace the HTTP requests sent by your Python code”Submitted Public CDNs Are Useless and Dangerous as a story · 6 points
HN discussion> IMHO the way to achieve this is to pay the upfront cost of building out a small framework for your application And then 5 years down the line it has grown into a worse version of the popular alternatives, the original developers are gone and the ones who currently maintain the mess have to pay the price. In corporate or professional contexts, you probably just should pick whatever is popular. Though that anecdote…
Comment linking /blog/public-cdn-risks/
on “Cash: A small jQuery alternative for modern browsers”Submitted What is X-Forwarded-For and when can you trust it? as a story · 5 points
HN discussionYes and, at the same time practical support within programming language standard libraries & common tooling lags way behind: https://httptoolkit.com/blog/http3-quic-open-source-support-...
Comment linking /blog/http3-quic-open-source-support-nowhere/
on “HTTP3 Explained”Submitted Public CDNs Are Useless and Dangerous (2021) as a story · 5 points
HN discussionI'm the maintainer of HTTP Toolkit. In general the source for core components that can't really be used for anything else is AGPL, but all the generally reusable libraries are Apache 2 or similar. The goal is to share as much as possible, and let everybody access the source for everything, and fork for their own use or submit modifications or whatever, but without the risk that a proprietary product runs off with th…
Comment linking /docs/guides/docker/
on “Ask HN: What underrated open source project deserves more recognition?”Submitted 22 years later, YAML now has a media type as a story · 4 points
HN discussionhttps://httptoolkit.com - HTTP debugging proxy with really easy one-click launch to intercept android devices/browsers/docker containers/etc.
Comment linking /
on “Ask HN: What underrated open source project deserves more recognition?”Submitted Android 17 enables certificate transparency, and breaks custom CAs as a story · 3 points
HN discussion
