Make HTTP requests from your browser | Hacker News Reader

Make HTTP requests from your browser

hurl.it

142 pointsllambda66 comments

Hurl.it was originally created by Chris Wanstranth and Leah Culver at the 2009 Rails Rumble. We (Twilio) just took over maintenance of the project because it has some obvious utility when testing URL callbacks and webhooks. We want to make some improvements to it, so if you have any ideas or suggestions, I'd love to hear them. You can post them here or create an issue on the current home of the project on Github: https://github.com/twilio/hurl

And you can follow @hurlit for updates

It would be great if instead of a website you port it to a browser plug-in. It would achieve several things:

* Better security for the user (the paranoid in me do not want to send my credentials through a third party site).

* It could use the credentials stored in the browser (cookies, basic-auth, etc).

* The IP of the requester would not be hidden, allowing IP filtering for development servers.

* It could run on a PC that is not connected to internet.

For chrome, I like using the "REST Console" extension (https://chrome.google.com/webstore/detail/cokgbflfommojglbmb...), which I believe has all of the benefits you listed. The "credentials stored in a browser" thing is the main reason for me to be using it.

For Firefox I recommend Poster: https://addons.mozilla.org/en-US/firefox/addon/poster/

It will be gr8 if you can add OAuth signing support to hurl. Testing urls that need to be signed with OAuth is a major pain point.

You have may find MySpace's tool [0] or Google's OAuth Playground [0] or OAuth 2.0 Playground [1] helpful.

[0] http://wiki.developer.myspace.com/index.php?title=OAuth_Test... [1] http://googlecodesamples.com/oauth_playground/ [2] https://code.google.com/oauthplayground/

It is a great utility, thanks for taking it over and giving it more stability.

> Make HTTP requests from your browser

Ironically, this is exactly what the browser is for.

Yes, but "Make HTTP requests with custom action, headers & body from your browser" isn't as snappy.

If you just put the word "custom" in there I reckon it would make a big difference ;)

Yeah I had to read the title twice, just to make sure I read it correctly.

exactly. I thought: uhm, isn't it what I'm doing right now?

Unless you want to make put or delete requests.

Hurl http://victim.org/index.php?a=;DROP DATABASE users --

What I want to say is that services like this have a security flaw by design which allows random people to execute strange statements in the name of Hurl.

There are certainly other ways to execute malicious HTTP requests (for example, let the Google Bot do it), but still, it should be pointed out.

By "services like this", I hope you mean websites that are vulnerable to SQL injection, and not Hurl itself?

Hoping that an attacker can't use curl probably isn't a good security solution...

Yes, not Hurl itself. But Hurl can be used to execute malicious statements.

It is a difference, whether an attacker uses his own IP address (or a setup with various VPNs and proxies) or uses Hurl for it so that the target website sees only Hurl's IP in its logs.

In times of free WiFi, the traceability of malicious requests is definitely reduced anyway, but Hurl could potentially add another layer that can be used by an attacker to obscure his/her origin. I'm not saying that this is a major security issue, it is just a flaw by design, which I wanted to point out.

Do you happen to know how translate.google.com deals with this problem ?

Meh, if abuse is really a problem Hurl could log requests and cooperate with law enforcement to trace it right back to you.

If an attacker is relying on using Hurl as their only source of anonymity they're not very competent.

You can make a browser GET or POST to any arbitrary URL already via JavaScript.

Yeah they are potentially liable to the same sort of issues that proxies are which can make for a legally vulnerable service - unfortunate but true

There is a http header, which you can set as proxy which reveals the ip of the original requester. Maybe that would be a good first step.

On mobile so i can't check myself: does The BROWSER makes the request by some clever way? Or simple server side script does it?

server side:

http://checkip.dyndns.com/ -> http://hurl.it/hurls/6fb24ac23d7c64a7edbcfceecd77c3d02586416...

127.0.0.1 -> http://hurl.it/hurls/7ad9448295a320acfe11160f0a8986fa591329f...

It's a ruby app, and uses curl on the server to make the request: https://github.com/defunkt/hurl/blob/master/app/app.rb

If you're on OSX, take a look on http://ditchnet.org/httpclient/

Very useful - to send a curl to someone - to explain why a response is incorrect or provide context about a service response... Sure you could use curl + gist - but there is something I nicer here - for example on my iPhone I could use hurl.it to explain a bad response via email without having to drop into a shell... Great service thanks!

So my browser will send an HTTP request to this website which in turn sends an HTTP request? We need to go deeper…

Source is here:

https://github.com/defunkt/hurl

It's a pretty thin proxy.

Sadly Hurl won't make requests to itself.

What I want is a website that can now render that http response into a fully formed webpage and display that in my browser.

And use that newly generated website to make another http request!

I would pay for a better hurl.it (common templates, saved responses, etc, etc...).

It's been an absolutely indispensable tools for debugging (crazy) API's while developing https://zapier.com.

No need to pay, we (Twilio) are now actively maintaining it and going to be adding some new features. Common templates exists (not documented) yet. You can put values in URL parameters and the fields will autopopulate effectively giving you URL-based templates. Responses are already saved, click the permalink to get back to them later.

If you have any other feedback items, feel free to post them here or on https://github.com/twilio/hurl and we'll take a look at them. Pull requests are even better.

Had no clue this was open source. Wonderful.

Have you considered using something like Charles Proxy[1] instead?

[1]: http://www.charlesproxy.com/

There is some FOSS alternative if I recall correctly but I forgot the name. I think it was written in Java.

The Cocoa-specific app looks interesting, but I think the Java-based alternative you were referencing was Paros[1]?

[1]http://www.parosproxy.org/download.shtml

CocoaRestClient? http://code.google.com/p/cocoa-rest-client/

Paros?

I have not. Brilliant link. Thank you!

If you're on OS X, I sell one for $2 on the Mac App Store - http://www.uresk.net/httpclient/. I'm working on a major update, and I'd be interested in hearing some more details about the features that would make a tool like this useful to you.

If you (or anyone else on HN) want to check it out but don't want to shell out a few bucks for it, send me an email (<my username>@gmail.com) and I'll get you a coupon code for a free copy.

Fiddler is a very useful HTTP proxy debugger for Windows.

http://www.fiddler2.com/fiddler2/

Have you tried Firefox's Poster Addon? It's absolutely brilliant for simulating HTTP requests

For specific APIs, apigee have a great tool: http://apigee.com/about/products/free

A hurl.it along those lines would be very useful.

See also: XHR Poster (Chrome extension) [1]

I couldn't live without it.

[1] http://goo.gl/UFSdZ

Older and better (a point of opinion):

http://www.rexswain.com/httpview.html

Since October 1999, actually.

This is useful if you are on systems where curl is not easily available. Helped a few times!

Interesting idea, could be very useful. One thing with this kind of service is always how they handle validation of data from the 3rd party service (eg, in headers). So as an example http://hurl.it/hurls/db870b49c7203ec9acb47ba7769c126146b1768... executes javascript in the context of their site... (just a pop-up box with hi, but could be any script..)

A pull request or issue created on https://github.com/twilio/hurl would be fantastic :)

Done ;-)

https://github.com/twilio/hurl/pull/9

I've used this extensively before; brilliant little service, but I've recently started using the "REST Console" Chrome extension, which is bloody brilliant:

https://chrome.google.com/webstore/detail/cokgbflfommojglbmb...

That's kind of handy for looking to see where irritating shortened links are redirecting - e.g. t.co or bit.ly

http://tools.pingdom.com/fpt/ gives you an image too :)

Something fun to point it at: http://httpong.com

Particularly http://httpong.com/response but the other parts can show you what hurl.it is sending.

Or http://httpbin.org

Do you have some limits in place, or can I just expect it to proxy all of my web traffic when I want it to (which I can do with one JS statement right on this page)? Magic WebKit Inspector is going to ruin your hosting bill.

Minor bug-report: when you keep clicking on the 'Send' button continuously it will occasionally show the JSON response in-browser instead of updating the UI.

And no, I'm not crazy. I was trying to test GitHub's rate-limiting. ;)

Thanks for the report, can you put this into the issues list on https://github.com/twilio/hurl?

Somewhat similar but more useful for debugging "HTTP caching" by Mark Nottingham: redbot (http://redbot.org/)

Yeah... thats the funny thing about web browsers... the tend to do that

Useful service, but this has been around for many months now..

Homer: They have HTTP in browsers now?

Sooo, web based curl? Amazing! #not

I take it you've never had "What's curl?" as a response when trying to show someone an API is working fine?

Well, maybe you're right. I assumed that people programming against REST API's know basic tools like curl, but apparently I got that wrong.

Yep. I've encountered plenty of cargo-cult programmers who know how to copy-paste code examples but who are SOL when it comes to troubleshooting.

Reply on news.ycombinator.com