Running Fiddler as a reverse proxy for an HTTPS server

Question

I have the following situation: 2 nodes, one is the client and the other is the HTTPS server.

Client (:<brwsr-port>) <=============> Web server (:443) 

I installed Fiddler on the server so that I now have Fiddler on my server on port 8888.

The situation that I would like to achieve is as follows:

 |Client (:<brwsr-port>)| <===> |Fiddler (:8888) <===> Web server (:443)| |-Me-------------------| |-Server--------------------------------| 

On my computer, I want to contact Fiddler, which redirects traffic to a web server. However, the web server uses HTTPS.

On the server, I configured Fiddler to handle HTTPS sessions and decrypted them. I was asked to install a fake CA certificate on the Fiddler server, and I did it! I also added a script suggested by the Fiddler wiki to redirect HTTPS traffic

 // HTTPS redirect ----------------------- FiddlerObject.log("Connect received..."); if (oSession.HTTPMethodIs("CONNECT") && (oSession.PathAndQuery == "<server-addr>:8888")) { oSession.PathAndQuery = "<server-addr>:443"; } // -------------------------------------- 

However, when I try https://myserver:8888/index.html , I fail!

Failure Details

When using Fiddler on the client, I see that the CONNECT request is starting, but the session fails because the response is HTTP error 502. It looks like no one is listening on port 8888. Actually, if I stop Fiddler on the server I get this same situation: 502 bad gateways.

Please note that when you try https://myserver/index.html and https://myserver:443/index.html everything works!

Question

What am I doing wrong?

Is it possible that ...?

I thought that since TLS / SSL might be running on port 443, I would need to listen to Fiddler and move my web server to another port, such as 444 (maybe I should set the IIS https binding on port 444). Is it correct?

Answer 1

If Fiddler is not configured as a client proxy and instead acts as a reverse proxy on the server, things get a little more complicated.

Running Fiddler as a reverse proxy for HTTPS

• Move your existing HTTPS server to a new port (e.g. 444)
• Inside Tools> Fiddler Options> Connections, click Allow Remote Clients to Connect . Restart Fiddler.
• Inside the Fiddler QuickExec window, type !listen 443 ServerName Listen !listen 443 ServerName , where ServerName is the host name of the server; for example, for https://Fuzzle/ you would use fuzzle for the server name.

• Inside the OnBeforeRequest method, add:

   if ((oSession.HostnameIs("fuzzle")) && (oSession.oRequest.pipeClient.LocalPort == 443) ) { oSession.Host = "fuzzle:444"; } 

Why do you need this?

The !listen command tells Fiddler to create a new endpoint that will handle HTTPS handshaking with the client when connecting; the proxy endpoint does not do this by default, because when the proxy server receives a connection for HTTPS traffic, it receives an HTTP CONNECT request instead of a handshake.

Answer 2

I faced a similar situation when I have VS2013 (IISExpress) running a web application on HTTPS (port 44300) and I wanted to view the application from a mobile device.

I configured Fiddler to "act as a reverse proxy" and "allow remote clients to connect," but it will only work on port 80 (HTTP).

Following EricLaw’s suggestion, I changed the listening port from 8888 to 8889 and !listen 8889 [host_machine_name] command “ !listen 8889 [host_machine_name] ”, and I could bingo view the application on HTTPS on port 8889.

Note. Earlier, I entered the registration port number in the registry ( as described here ), so Fiddler already knew which port forwards requests to.