The Curious Engineer

All blogs / Web development

HTTP Toolkit

httptoolkit.com/blog

Dig into HTTP in depth, hear about new HTTP Toolkit features & development, and explore a world of debugging & reverse engineering topics.

Web developmentNetworkingSecurityReverse engineering

’19’20’21’22’23’24’25’26
Posts
72 from 17 Jan 2019 to 23 Sep 2026
Posting
now and then (3 in the last year)
Kind
company blog
Feed
https://httptoolkit.com/rss.xml

2026 3

  1. Android 17 enables certificate transparency, and breaks custom CAs
  2. Dictionary Compression is finally here, and it's ridiculously good
  3. Funding the OSS Stack: HTTP Toolkit & Open Source in 2025

2025 1

  1. HTTP/3 is everywhere but nowhere

2024 5

  1. HTTP Toolkit is joining the Open Source Pledge
  2. ERR_PROXY_CONNECTION_FAILED errors with HTTP proxies
  3. Designing API Errors
  4. 22 years later, YAML now has a media type
  5. What is X-Forwarded-For and when can you trust it?

2023 10

  1. Working with the new Idempotency Keys RFC
  2. A brief introduction to OpenAPI
  3. 6 ways to debug an exploding Docker container
  4. New ways to inject system CA certificates in Android 14
  5. Android 14 blocks modification of system certificates, even as root
  6. Apple already shipped attestation on the web, and we barely noticed
  7. Leaking secrets through caching with Bunny CDN
  8. Automatic npm publishing, with GitHub Actions & npm granular tokens
  9. Dodge the next Dockerpocalypse: how to own your own Docker Registry address
  10. EU Funding for Mobile App Traffic Interception

2022 4

  1. Debugging WebRTC, IPFS & Ethereum with HTTP Toolkit
  2. Testing libraries for the Decentralized Web
  3. How to intercept, observe & mock WebRTC traffic
  4. Android Chrome 99 expands Certificate Transparency, breaking all MitM dev tools

2021 21

  1. Fighting TLS fingerprinting with Node.js
  2. Reverse engineering & modifying Android apps with JADX & Frida
  3. New HTTP standards for caching on the modern web
  4. EU Funding for Dev Tools for the Decentralized Web
  5. Proxies are complicated: RCE vulnerability in a 3 million downloads/week NPM package
  6. HTTPS certificate non-validation vulnerability in Node.js
  7. Safari isn't protecting the web, it's killing it
  8. Public CDNs Are Useless and Dangerous
  9. Defeating Android Certificate Pinning with Frida
  10. Encoding your HTTP for fun and profit
  11. Build an HTTPS-intercepting JavaScript proxy in 30 seconds flat
  12. One Port to Rule Them All
  13. Defining a new HTTP method: HTTP QUERY
  14. What are CORS proxies, and when are they safe?
  15. Intercept and edit HTTP traffic from (almost) any Android app
  16. How to intercept & debug all Java HTTPS
  17. HTTPWTF
  18. Cache your CORS, for performance & profit
  19. Fixing DNS in Node.js
  20. How to Index 226,379 API Endpoints
  21. The right way to turn off your old APIs

2020 18

  1. Mining your CLI history for good git aliases
  2. How do you know what's gone wrong when your API request fails?
  3. Intercepting HTTPS on Android
  4. Migrating a JS project from Travis to GitHub Actions
  5. How to Debug Any CORS Error
  6. Android 11 tightens restrictions on CA certificates
  7. GraphQL the Simple Way, or: Don't Use Apollo
  8. Inspecting Android HTTP with a fake VPN
  9. How to Debug Node.js Segmentation Faults
  10. Translating between HTTP/1 and HTTP/2
  11. What's coming in TypeScript 4?
  12. Bye bye Feature-Policy, hello Permissions-Policy
  13. How will user-agent client hints work?
  14. Ignore HTTP Client Errors At Your Peril
  15. HTTP 555: User-Defined Resource Error
  16. Chrome 79+ no longer shows preflight CORS requests
  17. Global developer CAs considered harmful
  18. Free as in Beer

2019 10

  1. How to Debug Anything
  2. A Crash Course in Price Localization
  3. The 5 Big Features of TypeScript 3.7 and How to Use Them
  4. Unblocking Node With Unref()
  5. Notarize your Electron App with Electron Forge
  6. X-Ray Debugging for HTTP
  7. Bundling Remote Scripts with Webpack
  8. Debugging Netlify Function Errors with Sentry
  9. One-click HTTP debugging for any CLI tool
  10. Welcome to the HTTP Toolkit blog