
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
a charles/fiddle like web proxy for developers which can intercept https requests without browser warning
While there are lots of proxy written by nodejs in github, most of them can not handle users' HTTPS requests perfectly. A typical problem is that the browser will throw warning like INVALID_CERTIFICATE when they want to intercept some https requests.
A simple and fast solution is to short the traffic between the user and the target server. That is to say, what the proxy do is to forward all the traffic of both sides, without intercepting or looking inside. This is useful when you want to establish a standard proxy and forwarding data. But this can also be useless when being used as a debug tool.
To work as a debug tool of HTTPS, the proxy itself should do two things: intercept the request and cheat the browser with a valid certificate,aka the man-in-the-middle(MITM) attack.
In order to have a browser-trusted certificate, we would sign certificates dynamically. The first thing to do is to generate a self-signed root CA and import to the system keychain. After trusting this CA, all child certs inherit from root CA can be naturally trusted by the browser.
What this proxy do is to generate and replace a temporary cert for any domain if neccessary. Using it, we can intercept any requests for debug. BTW, this is also what the charlse/fiddler do when you check the enable_ssl_proxy in preference.
openssl
should be exposed to your shellnpm install -g anyproxy
, may need sudo
anyproxy --root
,follow the instructions on screenanyproxy
anyproxy --port 8001
anyproxy --type https --host my.domain.com
host
is required with https proxy and it should be kept exactly what it it when you config your browser. Otherwise, you may get some warning about security.npm install anyproxy
var proxy = require("anyproxy");
!proxy.isRootCAFileExists() && proxy.generateRootCA();
proxy.startServer("http","8001", "localhost" ,"path/to/rule/file");
anyproxy --clear
anyproxy --rule /path/to/ruleFile.js
var rules = {
"map" :[
{
"host" :/./, //regExp
"path" :/\/path\/test/, //regExp
"localFile" :"", //this file will be returned to user when host and path pattern both meets the request
"localDir" :"~/" //find the file of same name in localdir. anyproxy will not read localDir settings unless localFile is falsy
}
,{
"host" :/./,
"path" :/\.(png|gif|jpg|jpeg)/,
"localFile" :"/Users/Stella/tmp/test.png",
"localDir" :"~/"
}
]
,"httpsConfig":{
"bypassAll" : false, //by setting this to true, anyproxy will not intercept any https request
"interceptDomains":[/www\.a\.com/,/www\.b\.com/] //by setting bypassAll:false, requests towards these domains will be intercepted, and try to meet the map rules above
}
}
module.exports = rules;
Author : Otto Mao, from Shanghai,China ottomao@gmail.com
Please feel free to raise any issue about this project, or give me some advice on this poor english doc. :)
FAQs
A fully configurable HTTP/HTTPS proxy in Node.js
The npm package anyproxy receives a total of 1,523 weekly downloads. As such, anyproxy popularity was classified as popular.
We found that anyproxy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.