Docs / Intercept & Modify

Intercept & Modify Pause, edit, and control HTTP traffic in real time

ProxyServer can pause matching requests and responses mid-flight, letting you inspect them, modify any part (method, URL, headers, body, status code), then forward or drop them. This is essential for testing how servers and clients react to unexpected data.

How Interception Works

Request Flow (Intercept ON + matching rule): Browser ──► Proxy ──► PAUSED ──► Dashboard shows edit modal │ ┌──────────┴──────────┐ │ │ [Forward] [Drop] │ │ ▼ ▼ Request sent to Connection reset upstream server Client gets 502 │ ▼ Response received │ ▼ PAUSED (if response rule matches too) │ ┌─────────┴─────────┐ │ │ [Forward] [Drop] │ │ ▼ ▼ Client receives Client gets 502 (modified) response

Two things must be true for interception to happen:

  1. Intercept is globally ON — Toggle the "Intercept" button in the topbar (or press i)
  2. A matching rule exists — At least one enabled rule must match the request

Managing Rules

Click Rules in the topbar to open the rules modal. Rules define which requests get intercepted.

Rule Fields

FieldDescriptionExample
urlPatternGlob pattern matched against the full URL. * matches any sequence of characters.*api/users*
methodHTTP method filter. * matches any method.POST
contentTypeSubstring match on the Content-Type header.json
headerKeyMatch requests with this header present.authorization
headerValueSubstring match on the header's value.Bearer
directionWhich phase to intercept: request, response, or both.request

Glob Pattern Matching

The urlPattern uses simple glob syntax:

PatternMatchesDoesn't Match
*api*https://example.com/api/v1/usershttps://cdn.example.com/styles.css
*login*https://auth.example.com/loginhttps://example.com/logout
*.jsonhttps://example.com/data.jsonhttps://example.com/data.xml
*example.com*Any URL to example.comAny other domain
All match criteria combine with AND logic. If you set both urlPattern: *api* and method: POST, only POST requests to URLs containing "api" will be intercepted.

Creating Rules via the API

# Create a rule to intercept all POST requests to any /api/ endpoint
curl -X POST http://localhost:9081/api/rules \
  -H "Content-Type: application/json" \
  -d '{
    "urlPattern": "*api*",
    "method": "POST",
    "direction": "request"
  }'

# List all rules
curl http://localhost:9081/api/rules

Request Interception

When a request matches a rule with direction: "request" or "both":

  1. Request pauses

    The entry's state changes to intercepted and its row turns yellow in the traffic list. The client's connection hangs, waiting.

  2. Edit modal appears

    The dashboard shows a modal with editable fields:

    • Method — Change GET to POST, etc.
    • URL — Modify the path and query string
    • Headers (JSON) — Edit the full header object
    • Body — Modify the request body
  3. Forward or Drop
    • Forward — Sends the (potentially modified) request to the upstream server
    • Drop — Aborts the request. The client receives a 502 Bad Gateway

Response Interception

When a response matches a rule with direction: "response" or "both":

  1. Full response is buffered

    The proxy receives the complete response from the upstream server and buffers it in memory.

  2. Response pauses

    The entry's state changes back to intercepted with phase: "response".

  3. Edit modal appears

    The modal shows response-specific fields:

    • Status Code — Change 200 to 404, etc.
    • Original URL — Read-only, for reference
    • Headers (JSON) — Edit response headers
    • Body — Modify the response body
  4. Forward or Drop
    • Forward — Sends the (potentially modified) response to the client
    • Drop — Aborts. Client gets 502 Bad Gateway
Response interception buffers the entire response body. For large files (multi-MB downloads), this increases memory usage temporarily. The client receives no data until you click Forward.

Auto-Forward Timeout

Intercepted requests and responses auto-forward after 5 minutes if you don't act on them. This prevents:

Common Use Cases

1. Test error handling

Intercept responses and change 200 to 500 to see how your app handles server errors.

2. Modify API responses

Change JSON response bodies to test edge cases — empty arrays, missing fields, unexpected values.

3. Inject authentication headers

Intercept requests and add/modify the Authorization header to test different user sessions.

4. Simulate slow responses

Intercept a response, wait 10 seconds, then forward — your app experiences a 10-second delay.

5. Block specific requests

Drop analytics, tracking, or third-party requests to see how your app behaves without them.

Previous ← Dashboard Guide