Skip to main content

How to replay a request to an HTTPS tunnel and export it

Since app version 1.4.0

Pick a request in the inspector's log (how to open it) and click "Replay": it goes to the service on your computer again. Replaying, adjusting and exporting a request are free on every plan.

Where a replay goes​

  1. Open the "Requests" tab of an HTTPS tunnel and pick a row in the log.
  2. Click the arrow on the "Replay" button and pick one of the "How to replay" options:
    • "Straight to the service": the request goes to the service inside your computer, without going over the internet, uses none of the plan's traffic, and the link's login doesn't get in its way. The "Replay" button itself does the same.
    • "Over the internet": the request goes to the link, the way a visitor's does: it also shows in the log as a visitor's row, the plan's traffic is spent, and on a link with a login the sign-in stops it: the inspector doesn't keep the sign-in key, so put it in the X-Proxima-Auth header with "Edit and send".
    • "N times…": a replay many times, on Pro and Ultra.

To adjust the request first, click "Edit and send": in the window, next to the request's path, pick "Direct" or "Over the internet". In the same kind of window you build a "New request" from scratch, from a curl command or from a browser's HAR file.

Check: a new row with the service's answer shows up in the log.

Webhook senders​

The inspector recognises Telegram, YooKassa, Stripe, GitHub, T-Bank, CloudPayments, Slack, GitLab, Sentry and Linear by itself and shows the event. Senders of your own, by a header or a JSON field, are added in the "⋯" menu above the log: "Webhooks…" → "Own senders". It's a hint, not a proof: anyone can send these signs.

A webhook's signature on a replay​

A webhook's "Signature" tab tells you whether the receiver will accept the replay. The signature won't match if the request was changed where it is signed, or if the signature is over 5 minutes old and the sender signs the time, as Stripe does. Then, on Pro and Ultra, the inspector signs the replay again with your signing key.

  1. On the "Signature" tab, click "Signing key". The "⋯" menu above the log opens the same window: "Webhooks…" → "Signing keys".
  2. Pick the sender: Stripe, Slack, GitHub, T-Bank, CloudPayments or "Own HMAC rule".
  3. In "Key", paste the secret the way the sender's dashboard shows it: for Stripe it's the whole whsec_….
  4. To keep the key after the app restarts, turn on "Remember on this computer". Without it, the key lasts until the tunnel closes. The switch works only for a link with a reserved address.
  5. Click "Save key".

The inspector neither shows nor exports the key, and "Forget the key" deletes it.

For a webhook, the "Edit and send" window has "How to sign". "Auto" signs anew only if your key reproduces the signature of the request that came in: a forged webhook never gets signed with your key. "Sign anew" signs the request in any case, and "Do not sign" sends it as it is.

Check: in the new log row, your handler accepted the replay instead of answering with a signature error.

How to export a request​

On a log row, click "⋯" → "Export…" and in "What" pick "This row" or "Everything shown". The "⋯" menu above the log → "Export shown…" also exports everything the log shows now. The formats: curl, PowerShell, fetch, Python, HTTPie, Go, PHP, C#, Java, a HAR file and a Postman collection.

Tokens, passwords and cookies go into the export as [masked], while the request's body and the link's address go as they are: check the export before you hand it on. The "With the real values of secrets" switch exports the real values.

Check: after "Copy" the window says "Copied", and "Save file" saves the export as a file.