HTTP/HTTPS debugging proxy


is a HTTP/HTTPS debugging proxy which allows to use collection of middlewares/interceptors in order to trace/pre-process/post-process requests and resposes. The proxy in HTTPS mode actually allows simulate the man-in-the-middle (mitm) attack or traffic hijacking. Concept of middlewares is similar to connect (expressjs) frameworks.

npm i thin
var Thin = require('thin');
var proxy = new Thin;
// `req` and `res` params are `http.ClientRequest` and `http.ServerResponse` accordingly 
// be sure to check for more details 
proxy.use(function(reqresnext) {
  console.log('Proxying:', req.url);
// you can add different layers of "middleware" similar to "connect", 
// but with few exclusions 
proxy.use(function(reqresnext) {
  if (req.url === '/foobar')
    return res.end('intercepted');
proxy.listen(8081, 'localhost', function(err) {
  // .. error handling code .. 
var express = require('express');
var app = express();
app.use(express.urlencoded({limit: '10mb'}));
app.get('/test', function(reqres){
  console.log(req.protocol, 'get req.query', req.query);
  res.end('get: hello world');
});'/test', function(reqres) {
  console.log(req.protocol, 'post req.query', req.query);
  console.log(req.protocol, 'post req.body', req.body);
  res.end('post: hello world');
app.all('/foobar', function(reqres) {
  // this route won't be reached because of mitm interceptor 
app.listen(3000, function(err) {
  if (err) console.log('http server', err)
var fs = require('fs');
var https = require('https');
  key: fs.readFileSync('./cert/dummy.key'), // your server keys 
  cert: fs.readFileSync('./cert/dummy.crt')
}, app).listen(3001, function(err) {
  if (err) console.log('https server', err)

If you try to make a query to your server you should be able to see a log from thin:

curl -d "foo=baz" -k -x https://localhost:8081 https://localhost:3001/test?foo=bar curl -d "foo=baz" -x http://localhost:8081 http://localhost:3000/test?foo=bar

You can intercept particular route:

curl -d "foo=baz" -k -x https://localhost:8081 https://localhost:3001/foobar

Response should be intercepted instead of original.