Fiddler Web Debugger

Automatic Authentication with the Request Builder

EricLaw — Thu, 12 Aug 2010 16:49:00 GMT

The Request Builder feature in recent versions of Fiddler includes a number of enhancements, including the ability to follow HTTP redirections, and to automatically authenticate (using the current user's credentials) to servers that demand authentication using the NTLM or Negotiate (NTLM/Negotiate) challenge-response protocols. Following redirections is simple enough, but properly constructing a response to a server's Negotiate authentication request entails some very complicated code. The problem is that while .NET can automatically add credentials to HTTPWebRequest objects, there's no trivial way to calculate the challenge-response string when you're using a socket directly (as Fiddler does).

Fortunately, a (now-defunct) blog post from "Jeff" suggested a hack that works rather well—use Reflection to grab internal fields (including the challenge-response string) from a dummy WebRequest object. While using Reflection to grab internal fields is inherently fragile (e.g. subject to breakage in updated versions of the framework) this particular trick appears to work reliably in both .NETv2 and .NETv4 frameworks.

Each Fiddler session keeps a dummy WebRequest variable which is not initialized by default.

private WebRequest __WebRequestForAuth = null;

If, however, the server returns a WWW-Authenticate header demanding NTLM or Negotiate, and the Session Flag x-Builder-AutoAuth is present on the session, then the object will be initialized, with the current session's URL:

if (null == __WebRequestForAuth) 
{   
    __WebRequestForAuth = HttpWebRequest.Create(this.fullUrl);
}

Then, we use Reflection to get the Authorization String we'll be adding to the request

try                
{                    
#region Use-Reflection-Magic-To-Tweak-Internals                    
    Type tWebReq = __WebRequestForAuth.GetType();
    tWebReq.InvokeMember("Async", BindingFlags.Default 
| BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.SetProperty, null, __WebRequestForAuth, new object[] { false });

    object objServerAuthState = tWebReq.InvokeMember("ServerAuthenticationState", BindingFlags.Default | BindingFlags.NonPublic | 
     BindingFlags.Instance | BindingFlags.GetProperty, null, __WebRequestForAuth, new object[0]);                    
    
    if (objServerAuthState == null) throw new ApplicationException("Auth state is null");

    Type tAuthState = objServerAuthState.GetType(); 
    tAuthState.InvokeMember("ChallengedUri", BindingFlags.Default | BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.SetField, null, objServerAuthState, new object[] { new Uri(this.fullUrl)});                    
#endregion Use-Reflection-Magic-To-Tweak-Internals

    string sAuthString = (bIsProxyAuth) ? oResponse["Proxy-Authenticate"] : oResponse["WWW-Authenticate"];

    // Next line uses default creds for current user. You could manually specify like so = new NetworkCredential("user", "pass", "domain") :
    ICredentials oCreds = CredentialCache.DefaultCredentials;  // This may throw, due to clock skew, etc.                    
    Authorization auth = AuthenticationManager.Authenticate(sAuthString, __WebRequestForAuth, oCreds);
    if (null == auth) throw new Exception("AuthenticationManager.Authenticate returned null.");                     
    string sAuth = auth.Message;

    // Create the new session that we'll resend with credentials
    nextSession = new Session(oRequest.pipeClient, oResponse.pipeServer);
    if (!auth.Complete)
    {
        nextSession.__WebRequestForAuth = __WebRequestForAuth;
    }
    __WebRequestForAuth = null;

    // Set the headers and body for the new session, using the 
    // Challenge-Response that we Reflected out of the Framework
    nextSession.requestBodyBytes = this.requestBodyBytes;
    nextSession.oRequest.headers = (HTTPRequestHeaders)this.oRequest.headers.Clone();
    nextSession.oRequest.headers[bIsProxyAuth ? "Proxy-Authorization" : "Authorization"] = sAuth;
catch (Exception eX)
{
    FiddlerApplication.DoNotifyUser("Automatic authentication was unsuccessful.\n\n" + 
        eX.Message, "Automatic Authentication failed");
}

That's all there is to it.

-Eric

New Features in Fiddler 2.2.9.9 Beta

EricLaw — Fri, 23 Jul 2010 00:23:02 GMT

New features and fixes in the Beta.

The Find Sessions feature (CTRL+F) now supports searching with regular expressions.
Enhanced the "Compare Sessions" feature on the context menu (set fiddler.differ.ultradiff = "False" if you don't like it)
Use a preference to persist the Scaling Mode preference in the Image Inspector
Fix bug whereby the URL https://something/http://something would be incorrectly parsed
Fix handling of redirect URLs where there's no / before the query string

New features and fixes in the SyntaxView inspector:

Support REGEX: in the QuickFind box
Support "Format XML" in the context menu
Apply syntax-highlighting to SVG image XML

-Eric

New Features in FiddlerCore 2.2.9.9

EricLaw — Mon, 19 Jul 2010 01:34:00 GMT

Version 2.2.9.9 of the FiddlerCore .NET class library has been released. This new version includes a number of new features that make FiddlerCore more useful for a variety of traffic monitoring and capture scenarios. With the exception of the final improvement (Server Read Callback), all of these improvements are also available to extensions running inside the full Fiddler application.

Server Certificate Validation

FiddlerCore hosters will now have the opportunity to accept or reject the server-provided certificate when a HTTPS connection is made and traffic decryption is enabled. This enables a number of new scenarios:

Collection and storage of server-provided certificates
- e.g. analyze how many certificate chains are signed with MD5
Acceptance of certificates based on any criteria
- e.g. treat my development certificate as valid for every site
Rejection of certificates based on any criteria
- e.g. do not accept certificates from government CAs

You can attach an event handler for certificate validation thusly:

FiddlerApplication.OverrideServerCertificateValidation += 

    new OverrideCertificatePolicyHandler(FiddlerApplication_OverrideServerCertificateValidation);

And implement it like so:

/// <summary>

/// This callback allows your code to evaluate the certificate for a site and optionally override default validation behavior for that certificate.

/// You should not implement this method unless you understand why it is a security risk.

/// </summary>

/// <param name="sExpectedCN">The CN expected for this session</param>

/// <param name="ServerCertificate">The certificate provided by the server</param>

/// <param name="ServerCertificateChain">The certificate chain of that certificate</param>

/// <param name="sslPolicyErrors">Errors from default validation</param>

/// <param name="bTreatCertificateAsValid">TRUE if you want to force the certificate to be valid; FALSE if you want to force the certificate to be invalid</param>

/// <returns>TRUE if you want to override default validation; FALSE if bTreatCertificateAsValid should be ignored</returns>

static bool FiddlerApplication_OverrideServerCertificateValidation(string sExpectedCN, X509Certificate ServerCertificate, X509Chain ServerCertificateChain, 

                                                                    SslPolicyErrors sslPolicyErrors, out bool bTreatCertificateAsValid)

{

    if (null != ServerCertificate)

    {

        Console.WriteLine("Certificate for " + sExpectedCN + " was for site " + ServerCertificate.Subject + " and errors were " + sslPolicyErrors.ToString());

        if (ServerCertificate.Subject.Contains("fiddler2.com"))

        {

            Console.WriteLine("Got a certificate for fiddler2.com and we'll say this is also good for, say, fiddlertool.com");

            bTreatCertificateAsValid = true;

            return true;

        }

    }

    bTreatCertificateAsValid = false;

    return false;

}

If you do not implement this method, or you return false, unless Fiddler.CONFIG.IgnoreServerCertErrors is set to true standard certificate validation rules will be respected.

Prevent Storage of Streaming Traffic

A common scenario for FiddlerCore-based applications is to act as a traffic monitor only, looking only at the request and response headers. The log-drop-request-body and log-drop-response-body flags can be set on a session to ensure that the request and response body are discarded once the request is sent and the response is returned, but these flags only take effect when the response is completed. In the case of streaming data (e.g. an unending Internet radio feed) the hosting application’s memory usage will continue to grow unbounded because the response is never completed.

If a response is streamed (e.g. oSession.bBufferResponse == false) and the log-drop-response-body flag is set, FiddlerCore will discard traffic as it streamed to the client. Alternatively, you can use the following code:

FiddlerApplication.Prefs.SetBoolPref(

    "fiddler.network.streaming.ForgetStreamedData", true

);

…to set the have FiddlerCore discard streamed response data in all sessions, even without the log-drop-response-body flag.

Of course, if your application is not storing response data for examination, you typically should also set the preference:

FiddlerApplication.Prefs.SetBoolPref(

    "fiddler.network.streaming.abortifclientaborts", true

);

…to ensure that FiddlerCore will stop reading from the server if the client closes the connection to the FiddlerCore proxy during streaming.

OnReadResponseBuffer Callback

In very rare cases, it may be useful for an application to receive notice as each block of traffic is downloaded from the server. This raw data buffer is nearly useless for most applications because it provides none of the parsing conveniences available elsewhere in the Fiddler API. HTTP response headers and the response body are not delineated, and compressed/chunked traffic are not decoded or unchunked. However, for certain uses (e.g. counting the raw number of bytes received while streaming) this capability may be useful.

Fiddler.FiddlerApplication.OnReadResponseBuffer += 

    new EventHandler<RawReadEventArgs>(FiddlerApplication_OnReadResponseBuffer);

You can view or modify the bytes received like so:

// This event handler is called on every socket read for the HTTP Response. You almost certainly don't want

// to do this, but the code below shows how you can use it to mess up your HTTP traffic.

static void FiddlerApplication_OnReadResponseBuffer(object sender, RawReadEventArgs e)

{

    // NOTE: arrDataBuffer is a fixed-size array. Only bytes (0 to iCountOfBytes) should be read/manipulated.

    //

    // Just for kicks, lowercase every byte. Note that this will obviously break any binary content.

    for (int i = 0; i < e.iCountOfBytes; i++)

    {

        if ((e.arrDataBuffer[i] > 0x40) && (e.arrDataBuffer[i] < 0x5b))

        {

            e.arrDataBuffer[i] = (byte)(e.arrDataBuffer[i] + (byte)0x20);

        }

    }

    Console.WriteLine(String.Format("Read {0} response bytes for session {1}", e.iCountOfBytes, e.sessionOwner.id));

}

The RawEventArgs parameter contains four members: arrDataBuffer, iCountOfBytes, sessionOwner, and AbortReading. arrDataBuffer is a fixed-size byte array. iCountOfBytes is an integer indicating how many bytes of the arrDataBuffer array have been set by the read from the server. sessionOwner is a reference to the session for which the response is being read. The AbortReading member is a boolean which can be set to request that the read from the server be terminated as soon as possible.

Import/Export Architecture

Fiddler 2.2.9.7 introduced a new Import/Export Architecture to simplify the transcoding of Web traffic to and from multiple formats. FiddlerCore now supports this architecture, and provides default implementations for the Sesssion Archive Zip format.

You can direct FiddlerCore to load additional ISessionImport and ISessionExport classes from either your application’s assembly, or from the assembly of your choice. For instance, the following code will load the transcoders from Formats.dll in your application’s directory.

FiddlerApplication.oTranscoders.ImportTranscoders(

        Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location) + 

            @"Formats.dll"

);

It is important to note that FiddlerCore’s ISessionImport and ISessionExport interfaces are source-compatible with those in the Fiddler application, but they are not binary-compatible. If you want to share transcoders between a FiddlerCore application and Fiddler itself, you will have to compile your code into two individual assemblies, one Referencing Fiddler.exe and one Referencing FiddlerCore.dll.

The FiddlerCore package includes two source files, SAZ-DotNETZip.cs and SAZ-XCEEDZip.cs either of which will allow FiddlerCore-based applications to load and save SAZ-formatted archives. The former class requires the open-source DotNETZip library while the latter is based on the commercial XCeed Zip library.

To import sessions from a file in SAZ format, you can write code like so:

private static void ImportSessions(List<Fiddler.Session> oAllSessions)

{

   TranscoderTuple oImporter = FiddlerApplication.oTranscoders.GetImporter("SAZ");

   if (null != oImporter)

   {

       Dictionary<string, object> dictOptions = new Dictionary<string, object>();

       dictOptions.Add("Filename", Environment.GetFolderPath(Environment.SpecialFolder.Desktop) + @"\ToLoad.saz");

       Session[] oLoaded = FiddlerApplication.DoImport("SAZ", false, dictOptions, null);

       if ((oLoaded != null) && (oLoaded.Length > 0))

       {

           oAllSessions.AddRange(oLoaded);

           Console.WriteLine("Loaded: " + oLoaded.Length + " sessions.");

       }

   }

}

To export a set of sessions to a file, you can write code like so:

private static void SaveSessionsToDesktop(List<Fiddler.Session> oAllSessions)

{

    bool bSuccess = false;

    string sFilename = Environment.GetFolderPath(Environment.SpecialFolder.DesktopDirectory)

                  + @"\" + DateTime.Now.ToString("hh-mm-ss") + ".saz";SAZ");Filename", sFilename);Password", "pencil");SAZ", oAllSessions.ToArray(), dictOptions, null);Wrote: " + sFilename) : ("Failed to save: " + sFilename) );Save failed: " + eX.Message);

    try

    {

      try

      {

          Monitor.Enter(oAllSessions);

          TranscoderTuple oExporter = FiddlerApplication.oTranscoders.GetExporter("

          if (null != oExporter)

          {

              Dictionary<string, object> dictOptions = new Dictionary<string, object>();

              dictOptions.Add("

              dictOptions.Add("

              bSuccess = FiddlerApplication.DoExport("

          }

      }

      finally

      {

          Monitor.Exit(oAllSessions);

      }

      Console.WriteLine( bSuccess ? ("

    }

    catch (Exception eX)

    {

      Console.WriteLine("

    }

}

If desired, you may download and redistribute a FiddlerCore-compatible version of the BasicFormats assembly (supporting Import/Export of HTTP Archive JSON and HTTP Archive XML, and Export of Visual Studio Web Test XML, WCAT Load Test Scripts, and Raw Files).

I hope you find these new capabilities useful in building your applications. Please let me know if you encounter any problems!

-Eric Lawrence

FiddlerCap Now in Six Languages

EricLaw — Thu, 08 Jul 2010 22:42:00 GMT

The FiddlerCap Web Traffic Recorder allows non-technical end-users to collect Web Traffic captures, and send those captures to a debugging buddy for analysis.

I recently updated FiddlerCap and it can now render in any of six languages: English, Spanish, French, Japanese, Russian, and Portuguese. The product UI was translated by members of the Fiddler community, and the FiddlerCap web page is auto-translated by the Microsoft Translator widget.

Hopefully, support for these new languages will help make FiddlerCap even easier to use!

-Eric

Fiddler’s New Import and Export Architecture

EricLaw — Wed, 30 Jun 2010 22:48:00 GMT

All versions of Fiddler support a rich extensibility model that enables developers to enhance Fiddler with new functionality useful for traffic inspection, analysis, and sharing. However, writing extensions that import traffic captured by other tools was difficult, and extensions that offered traffic export often extended the UI in confusing ways or failed to implement basic functionality like progress reporting and the like. As announced at the Velocity 2010 conference, Fiddler 2.2.9.7 now supports an Import/Export architecture which allows you to easily import traffic from other tools and export traffic to formats beyond the Fiddler-native Session Archive ZIP (SAZ) format. Fiddler includes “out of the box” support the following formats:

Import

HTTP Archive JSON
HTTP Archive XML (exported from IE9 Developer Tools Network Tab)

Export

HTTP Archive JSON v1.1
HTTP Archive JSON v1.2
Visual Studio Web Test XML
WCAT Load Test Script
Raw Files

The two HTTP Archive JSON formats (*.har) are supported by a growing list of open-source and commercial tools and web services. The primary difference between v1.1 and v1.2 is that the newer format supports storage of non-textual response bodies. Because these HAR files are not compressed, Fiddler will only store non-textual content smaller than 32kb by default. This limit can be increased by setting the Fiddler Preference fiddler.importexport.HTTPArchiveJSON.MaxBinaryBodyLength.

Visual Studio Web Test XML and WCAT Load Test scripts are loadable by those tools to allow you to replay previously-captured requests for functional-testing and load-testing purposes. The Raw Files export format allows you to easily dump captured response files to a folder on disk; this allows you to easily collect audio, video, or image files for instance.

Beyond these default formats, developers can create their own Import and Export classes by implementing the appropriate interfaces using any .NET language. There’s no particular requirement that the classes store data in a file—you could build a class that saves or loads traffic from a local database or a data store in the cloud.

Developers of broadly useful Import/Export extensions can contact me to have them listed on the official Fiddler website.

I hope you will find this new functionality useful!

Eric Lawrence

Capturing (and changing) a Web Site with Fiddler

EricLaw — Mon, 21 Jun 2010 16:39:00 GMT

Often, the IE team will encounter a problem in a complicated production website, and will need to "reduce the repro" in order to determine the root cause of a given bug. This is made more complicated by the fact that sometimes the live website will change under us and we may lose the repro before the bug is fixed.

One of the common approaches we use to solve this problem is to collect a traffic capture of the website and store it in a local archive. Then, you can use Fiddler to "replay" that traffic back at any time, even modifying the traffic to simplify the repro.

To do this:

1> Clear your browser cache.

2> Start Fiddler.

3> Visit the site.

At this point, you have all of the traffic. There are a bunch of different approaches you can take, but because HTTP headers are often important, your best bet is to:

4> File > Save Session Archive Zip.

This will save a Fiddler SAZ file containing your traffic. You can import this SAZ file into Fiddler’s AutoResponder tab and play it back to future clients, without hitting the web. (This is how I do demos at conferences without fear of losing network connectivity).

Now, that will give you playback of your captured traffic, but you mentioned that you want to “reduce” the repro. This is easy enough. You can use Breakpoint Debugging, but for higher-volume manipulations:

5> Choose the session that you want to change in the session list.

6> Right-click, File > Save > Response > Entire Response.

7> Save it somewhere.

8> Edit it with notepad or whatnot. You should delete the Content-Length header entirely if you plan to change the body size.

9> Drag drop that file from Windows Explorer to Fiddler’s AutoResponder tab.

10> Move that rule to the top of the list by selecting it and pushing the + key.

Now, Fiddler will playback your locally modified URL for that file, and play everything else back based on the prior capture.

-Eric

No, Fiddler is not evil

EricLaw — Fri, 07 May 2010 23:14:00 GMT

Recently, a number of people have emailed me and indicated that their security software raised warnings or blocked their download of Fiddler from the official Fiddler website. Now, I’ve reached out to vendors to help them correct their false-positives, but there are many vendors of “security” software, and only one of me.

As an end-user, you can easily validate the integrity of the Fiddler download packages—they’re all digitally-signed with my certificate. You’ll see the certificate information presented by Windows before the installer runs:

If you want the full details, you can click the link provided to view all of the information in the signing certificate. For the super-detail oriented, you can even compare the signer's serial number against that of my certificate: 38 ce b3 26 90 c0 05 79 d1 c5 7d fb ea 88 80 c8.

If you’re not running IE8 yet, you should upgrade to take advantage of SmartScreen Filter, which helps protect you from socially-engineered malware, without the false-positives. :-)

-Eric

The Fiddler Community

EricLaw — Fri, 07 May 2010 14:42:00 GMT

With a development team of one, Fiddler is in many ways a product of the rich community and ecosystem that has developed over the last six years. While I try to keep the official site updated, there are many other outlets to take advantage of when looking for Fiddler-related news, help, and tools.

The primary user-to-user support site is the Fiddler Discussion Group. When hunting for even more Fiddler Q&A, you should check out StackOverflow (development-related), ServerFault (server-admin related), or SuperUser (regular end-user). From time-to-time, Fiddler Tweets appear on Twitter, and there’s a Fiddler Fans Page on Facebook. I’m sure there are other resources as well, but these are the ones that I routinely check out.

Beyond tutorials and Q&A, many in the community have stepped up to write Fiddler add-ons, a few of which you can find listed on the Fiddler Extensions page. Many of these add-ons are tremendously powerful and address a specific niche—testing security or performance, for instance. If you know of a broadly useful extension I haven’t listed, please let me know about it!

However, perhaps the most valuable product of the Fiddler Community has been the feedback which has shaped Fiddler itself. This feedback takes two major forms: Bug Reports, and Feature Requests.

Bug Reports (especially those that contain exception information or other reproduction steps) are tremendously valuable as they help ensure that Fiddler remains of high-quality. Such reports are even more valuable when reported from the beta version, so that I can fix problems before they make it into the release version.
Feature Requests usually take a while longer to bear fruit, but perhaps have an even greater impact—most of Fiddler’s most powerful and interesting features were built as a result of one or more (often more) users requesting a feature that would help them use Fiddler in their daily work.

So, to all of you in the Fiddler Community—thanks for helping to build a better Fiddler!

-Eric

Peeking Fiddler’s Internals

EricLaw — Wed, 05 May 2010 03:09:00 GMT

Fiddler 2.2.9 includes two new features that allow you to get some more insight into the state of the web debugger. The first allows you to inspect the caches used by Fiddler; simply type about:cache in the QuickExec box and Fiddler will display the current contents of its DNS Resolver cache and ServerPipe Pool on the Log tab.

Fiddler’s DNS Resolver cache stores previously-resolved DNS addresses for faster reuse, while the ServerPipe Pool enables reuse of keep-alive connections to web servers. By default, the DNS Resolver cache keeps entries for 150 seconds (fiddler.network.timeouts.dnscache) while the ServerPipe Pool keeps connections alive for up to 120 seconds (fiddler.network.timeouts.serverpipe.reuse). Both of these defaults can be adjusted using the Preferences System.

A typical response to about:cache looks like this:

ServerPipePool
fiddler.network.timeouts.serverpipe.reuse: 120000ms
Contents
--------
    [1] entries for 'www.bing.com:80'.
        ServerPipe#28[Key: www.bing.com:80; UseCnt: 2 [28,34,]; PlainText; Anonymous (:80 to 198.104.200.81:80 Direct) NoRestrictions]
    [1] entries for 'c.microsoft.com:80'.
        ServerPipe#26[Key: c.microsoft.com:80; UseCnt: 3 [26,27,33,]; PlainText; Anonymous (:80 to 65.55.57.252:80 Direct) NoRestrictions]
    [1] entries for 'm.webtrends.com:80'.
        ServerPipe#24[Key: m.webtrends.com:80; UseCnt: 4 [24,25,30,32,]; PlainText; Anonymous (:80 to 208.92.236.184:80 Direct) NoRestrictions]
    [1] entries for 'microsoftsto.112.2o7.net:80'.
        ServerPipe#23[Key: microsoftsto.112.2o7.net:80; UseCnt: 2 [23,31,]; PlainText; Anonymous (:80 to 66.235.133.1:80 Direct) NoRestrictions]
    [1] entries for 'blogs.msdn.com:80'.
        ServerPipe#22[Key: blogs.msdn.com:80; UseCnt: 2 [22,29,]; PlainText; Anonymous (:80 to 65.55.11.162:80 Direct) NoRestrictions]
--------
20:03:00:8183 DNSResolver Cache
fiddler.network.timeouts.dnscache: 150000ms
Contents
--------
    HostName: www.bing.com, Age: 15772ms, AddressList: [198.104.200.81, 198.104.200.26]
    HostName: c.microsoft.com, Age: 18253ms, AddressList: [65.55.57.252]
    HostName: m.webtrends.com, Age: 20671ms, AddressList: [208.92.236.184]
    HostName: microsoftsto.112.2o7.net, Age: 22995ms, AddressList: [66.235.133.1, 66.235.133.33, 66.235.132.152]
    HostName: blogs.msdn.com, Age: 27675ms, AddressList: [65.55.11.162]
--------

The second feature is called DebugSpew; it is a form of runtime tracing which shows detailed information about Fiddler’s operations. This incurs a significant performance penalty, so this feature is disabled by default. To enable DebugSpew, either set the registry key of the same name, or type !spew in the QuickExec box at runtime. After you do so, Fiddler will emit verbose logging information to the system’s debugging console, which you can view using the SysInternals DebugView tool. This output is primarily useful for finding bugs in Fiddler, but it can be interesting to some folks who want a deeper understanding of how Fiddler works.

That’s all for now,

-Eric

FiddlerCore and the .NET Client Profile

EricLaw — Wed, 05 May 2010 02:43:00 GMT

As the .NET Framework grew in size from version to version, there was an increase in the clamor for a smaller version of the Framework. The idea was that this smaller version would be quicker to download and install, with the tradeoff that it would support only client applications, leaving out the assemblies used by ASP.NET and other server applications. Starting in Version 3.5, the .NET Team answered that request by creating the .NET Framework Client Profile, a subset of the Framework which omits the classes that client applications are unlikely to use.

Until recently, FiddlerCore had a dependency on the System.Web.dll assembly. FiddlerCore relied upon the HttpUtility.HtmlEncode method when encoding error messages for display in the browser; the call was used to mitigate script-injection attacks. Unfortunately, that reliance meant that applications built on top of FiddlerCore would not run on the .NET Client Profile.

This limitation is fixed in FiddlerCore 2.2.9 and later; FiddlerCore now contains its own implementation of the HtmlEncode function, and no longer relies upon the System.Web.dll assembly. This means that FiddlerCore.dll will no longer itself introduce a dependency on classes not in the Client Profile. Note: The full version of Fiddler itself still uses a number of other APIs in System.Web and hence it does require a full-install of the Framework to run.

At some point in the near future, FiddlerCore will be made available in a CLR 4.0 version for developers who are building applications who are building applications which target the latest version of the CLR.

-Eric

Fiddler New Features – The Preferences System

EricLaw — Tue, 04 May 2010 04:05:00 GMT

Fiddler 2.2.9 is the first release with end-to-end support for a Preferences System, accessible to script and extensions, that will simplify the storage and reloading of user-preferences.

The system is somewhat similar to the preferences system within many web browsers; as in those browsers, you can type about:config in Fiddler’s QuickExec box to see the currently-configured preferences. Currently, Fiddler’s about:config screen is read-only, but users can use the prefs set command to manually adjust individual preferences.

The Preferences System uses unique string values as key names, each key can store a string, int32, or bool value, although internally the value is converted to a string for storage in the registry. FiddlerScript, in particular, can benefit from using the Preference System because FiddlerScript’s variables are reset to their defaults every time an updated script is loaded and compiled. By storing and loading values using the Preference System, FiddlerScript can store values across Fiddler sessions and despite script recompilation.

The Preferences System allows extensions or script to receive notification of changes to Preferences via Watchers, which notify a caller-supplied event-handler when a preference’s value is changed. Fiddler internally uses Watchers, like so:

// Call an event-handler anytime a UI Preference changesFiddlerApplication.Prefs.AddWatcher("fiddler.ui.", OnUIPrefChange); private void OnPrefChange(object sender, PrefChangeEventArgs oPref){    if (oPref.PrefName == "fiddler.ui.toolbar.visible")    {       miViewToolbar.Checked = (oPref.ValueString == bool.TrueString);    }}

To avoid circular-reference memory leaks, FiddlerScript callers should call the WatchPreference API instead:

// Callback function for Preference changesstatic function fnNotify(sender: Object, pceA: PrefChangeEventArgs){    FiddlerObject.alert(pceA.PrefName + " changed to " + pceA.ValueString);}    static function Main(){   // Notify callback anytime a preference changes under the fiddler.network branch   FiddlerObject.WatchPreference("fiddler.network", fnNotify);}

This will ensure that Fiddler tears down the notification callbacks when an updated version of your FiddlerScript is loaded.

A key design goal of Fiddler’s Preference System is to simplify the communication of state between the UI thread and the background threads used in Session processing. Instead of having background threads directly check the state of UI checkboxes and the like, they should instead check the state of Preferences which are themselves set by the UI thread.

A future version of the Fiddler Preferences System will support “profiles” which allow the user to quickly switch between sets of preferences suitable for a given task (e.g. “Traffic capture”, “Demo replay”, “Debugging”, etc).

To help developers understand how Fiddler’s Preference System works, the source is provided as follows:

// Documentation at http://fiddler.wikidot.com/prefs// This sample is provided "AS IS" and confers no warranties.
// You are granted a non-exclusive, worldwide, royalty-free license to reproduce this code,
// prepare derivative works, and distribute it or any derivative works that you create.
//
// TODO:// Add an internal version of the indexer that will allow skipping notification of Event handlers and setting of Internal Prefsusing System;using System.Collections.Specialized;using System.Diagnostics;using System.Threading;using Microsoft.Win32;using System.Collections.Generic;using System.Collections;using System.Text; namespace Fiddler{    #region EventArgs        /// <summary>    /// EventArgs for preference-change events.  See http://msdn.microsoft.com/en-us/library/ms229011.aspx.    /// </summary>    public class PrefChangeEventArgs : EventArgs    {        private readonly string _prefName;        private readonly string _prefValueString;         internal PrefChangeEventArgs(string prefName, string prefValueString)        {            _prefName = prefName;            _prefValueString = prefValueString;        }         /// <summary>        /// The name of the preference        /// </summary>        public string PrefName        {            get            {                return _prefName;            }        }         /// <summary>        /// The string value of the preference        /// </summary>        public string ValueString        {            get            {                return _prefValueString;            }        }         /// <summary>        /// Returns TRUE if ValueString=="true", case-insensitively        /// </summary>        public bool ValueBool        {            get            {                return ("True".Equals(_prefValueString, StringComparison.OrdinalIgnoreCase));            }        }    }    #endregion EventArgs       /// <summary>    /// The IFiddlerPreferences Interface    /// </summary>    public interface IFiddlerPreferences    {        /// <summary>        /// Store a boolean value for a preference        /// </summary>        /// <param name="sPrefName">The named preference</param>        /// <param name="bValue">The boolean value to store</param>        void SetBoolPref(string sPrefName, bool bValue);         /// <summary>        /// Store an Int32 value for a preference        /// </summary>        /// <param name="sPrefName">The named preference</param>        /// <param name="iValue">The int32 value to store</param>        void SetInt32Pref(string sPrefName, Int32 iValue);         /// <summary>        /// Store a string value for a preference        /// </summary>        /// <param name="sPrefName">The named preference</param>        /// <param name="sValue">The string value to store</param>        void SetStringPref(string sPrefName, string sValue);         /// <summary>        /// Get a preference's value as a boolean        /// </summary>        /// <param name="sPrefName">The Preference Name</param>        /// <param name="bDefault">The default value for missing or invalid preferences</param>        /// <returns>A Boolean</returns>        bool GetBoolPref(string sPrefName, bool bDefault);         /// <summary>        /// Gets a preference's value as a string        /// </summary>        /// <param name="sPrefName">The Preference Name</param>        /// <param name="sDefault">The default value for missing preferences</param>        /// <returns>A string</returns>        string GetStringPref(string sPrefName, string sDefault);         /// <summary>        /// Gets a preference's value as a 32-bit integer        /// </summary>        /// <param name="sPrefName">The Preference Name</param>        /// <param name="iDefault">The default value for missing or invalid preferences</param>        /// <returns>An integer</returns>        Int32 GetInt32Pref(string sPrefName, Int32 iDefault);         /// <summary>        /// Removes a named preference from storage        /// </summary>        /// <param name="sPrefName">The name of the preference to remove</param>        void RemovePref(string sPrefName);         /// <summary>        /// Add a Watcher which will be notified when a value has changed        /// </summary>        /// <param name="sPrefixFilter">The prefix of preferences for which changes are interesting</param>        /// <param name="pcehHandler">The Event handler to notify</param>        /// <returns>Returns the Watcher object added to the notification list</returns>        PreferenceBag.PrefWatcher AddWatcher(string sPrefixFilter, EventHandler<PrefChangeEventArgs> pcehHandler);         /// <summary>        /// Removes a previously-created preference Watcher from the notification queue        /// </summary>        /// <param name="wliToRemove">The Watcher to remove</param>        void RemoveWatcher(PreferenceBag.PrefWatcher wliToRemove);         /// <summary>        /// Indexer. Returns the value of the preference as a string        /// </summary>        /// <param name="sName">The Preference Name</param>        /// <returns>The Preference value as a string, or null</returns>        string this[string sName] {get; set; }    }     /// <summary>    /// The PreferenceBag is used to maintain a threadsafe Key/Value list of preferences, persisted in the registry, and with appropriate eventing when a value changes.    /// </summary>    public class PreferenceBag : IFiddlerPreferences    {        #region Fields        // NB: Using Dictionary<string, string> rather than a StringDictionary results in different behavior, like        // the indexer throwing an exception when looking up a non-existent key.         // StringDictionary is also case-insensitive, which is desirable.        private readonly StringDictionary _dictPrefs = new StringDictionary();        private readonly List<PrefWatcher> _listWatchers = new List<PrefWatcher>();         // TODO: Migrate to ReaderWriterLockSlim for .NET 3.5/4.0        //http://www.bluebytesoftware.com/blog/PermaLink,guid,54bf6c16-ce42-49d5-94db-aafbd7cb0c27.aspx        private readonly ReaderWriterLock _RWLockPrefs = new ReaderWriterLock();        private readonly ReaderWriterLock _RWLockWatchers = new ReaderWriterLock();         private string _sRegistryPath;        private string _sCurrentProfile = ".default";        #endregion           internal PreferenceBag(string sRegPath)        {            _sRegistryPath = sRegPath;            ReadRegistry();            Debug.WriteLine("created preferences object; loaded prefs: " + _dictPrefs.Count.ToString());        }         #region PrefNameValidation        static char[] _arrForbiddenChars = { '*', ' ', '$', '%', '@', '?', '!' };        private bool isValidName(string sName)        {            // TODO: Use RegEx to enforce A-z0-9-_            return ((!String.IsNullOrEmpty(sName)) &&                (256 > sName.Length) &&                                              // Prior to .NETv4, regkey names are limited to 255 characters.                (0 > sName.IndexOf("internal", StringComparison.OrdinalIgnoreCase)) &&                (0 > sName.IndexOfAny(_arrForbiddenChars)));        }        #endregion PrefNameValidation         #region Profiles        /// <summary>        /// Returns a string naming the current profile        /// </summary>        public string CurrentProfile        {            get            {                return _sCurrentProfile;            }        }         #endregion         #region RegistryPersistence        /// <summary>        /// Load the existing preferences from the registry into the Preferences bag.        /// </summary>        private void ReadRegistry()        {            if (null == _sRegistryPath)            {                return;            }            RegistryKey oReg = Registry.CurrentUser.OpenSubKey(_sRegistryPath + @"\" + _sCurrentProfile, false);            if (null == oReg) return;             string[] arrPrefs = oReg.GetValueNames();             try            {                _RWLockPrefs.AcquireWriterLock(Timeout.Infinite);                foreach (string sPref in arrPrefs)                {                    if (sPref.Length < 1) continue;                     if (sPref.Contains("ephemeral")) continue;                    try                    {                        _dictPrefs[sPref] = (string)oReg.GetValue(sPref, string.Empty);                    }                    catch (Exception eX)                    {                        // Registry key was probably of the wrong type...                        Debug.WriteLine(eX);                    }                }                // System.Windows.Forms.MessageBox.Show(String.Join("\r\n", GetPrefArray()));            }            finally            {                _RWLockPrefs.ReleaseWriterLock();                oReg.Close();            }        }         /// <summary>        /// Serialize the existing preferences to the Registry.        /// </summary>        private void WriteRegistry()        {            if (CONFIG.bIsViewOnly)            {                return;            }            if (null == _sRegistryPath)             {                return;            }            RegistryKey oReg = Registry.CurrentUser.CreateSubKey(_sRegistryPath);            if (null == oReg)            {                Debug.Assert(false, "Cannot serialize Preference bag!");                return;            }             try            {                _RWLockPrefs.AcquireReaderLock(Timeout.Infinite);                           // Wipe the old values                oReg.DeleteSubKey(_sCurrentProfile, false);                 // Bail at this point if there are no preferences                if (_dictPrefs.Count < 1) { return; }                 // Create the Profile subkey                oReg = oReg.CreateSubKey(_sCurrentProfile);                 // Write the new values                foreach (DictionaryEntry dePrefVal in _dictPrefs)                {                    string sKey = (string)dePrefVal.Key;                    if (sKey.Contains("ephemeral")) continue;                    oReg.SetValue(sKey, dePrefVal.Value);                }            }            finally            {                _RWLockPrefs.ReleaseReaderLock();                oReg.Close();            }        }        #endregion RegistryPersistence                #region Indexer        /// <summary>        /// Indexer into the Preference collection.        /// </summary>        /// <param name="sPrefName">The name of the Preference to update/create or return.</param>        /// <returns>The string value of the preference, or null.</returns>        public string this[string sPrefName]        {            get            {                               try                {                    _RWLockPrefs.AcquireReaderLock(Timeout.Infinite);                    return _dictPrefs[sPrefName];                }                finally                {                    _RWLockPrefs.ReleaseReaderLock();                }             }            set            {                if (!isValidName(sPrefName))                {                    throw new ArgumentException(String.Format("Preference name must contain 1 or more characters from the set A-z0-9-_ and may not contain the word Internal.\nYou tried to set: \"{0}\"", sPrefName));                }                 if (value == null)                {                    RemovePref(sPrefName);                    return;                }                 bool _bNotifyChange = false;                try                {                    // Determine if the value existed & had the same value                    _RWLockPrefs.AcquireWriterLock(Timeout.Infinite);                    _bNotifyChange = (!_dictPrefs.ContainsKey(sPrefName) || (_dictPrefs[sPrefName] != value));                     // Write the preference. TODO: Should we skip the next line if we already know it's unchanged?                    _dictPrefs[sPrefName] = value;                }                finally                {                    _RWLockPrefs.ReleaseWriterLock();                }                if (_bNotifyChange)                {                    PrefChangeEventArgs oArgs = new PrefChangeEventArgs(sPrefName, value);                    AsyncNotifyWatchers(oArgs);                }            }        }        #endregion Indexer         /// <summary>        /// Get a string array of the preferences        /// </summary>        /// <returns>string[] of preference values</returns>        public string[] GetPrefArray()        {            try            {                _RWLockPrefs.AcquireReaderLock(Timeout.Infinite);                string[] arrResult = new String[_dictPrefs.Count];                _dictPrefs.Keys.CopyTo(arrResult, 0);                return arrResult;            }            finally            {                _RWLockPrefs.ReleaseReaderLock();            }        }         #region GetterHelpers        /// <summary>        /// Return a string preference.        /// </summary>        /// <param name="sPrefName"></param>        /// <param name="sDefault"></param>        /// <returns></returns>        public string GetStringPref(string sPrefName, string sDefault)        {            string sRet = this[sPrefName];            Debug.WriteLineIf(null == sRet, "[FiddlerPref] Lookup for non-existent preference " + sPrefName);            return (sRet ?? sDefault);        }         /// <summary>        /// Return a bool preference.        /// </summary>        /// <param name="sPrefName"></param>        /// <param name="bDefault"></param>        /// <returns></returns>        public bool GetBoolPref(string sPrefName, bool bDefault)        {            string sRet = this[sPrefName];            if (sRet == null)            {                Debug.WriteLine("[FiddlerPref] Lookup for non-existent preference " + sPrefName);                return bDefault;            }            else            {                bool bRet;                if (bool.TryParse(sRet, out bRet))      // Case-insensitive compare of "TRUE"/"FALSE"                {                    return bRet;                }                else                {                    return bDefault;                }            }        }         /// <summary>        /// Return an Int32 Preference.        /// </summary>        /// <param name="sPrefName"></param>        /// <param name="iDefault"></param>        /// <returns></returns>        public Int32 GetInt32Pref(string sPrefName, Int32 iDefault)        {            string sRet = this[sPrefName];            if (sRet == null)             {                Debug.WriteLine("[FiddlerPref] Lookup for non-existent preference " + sPrefName);                return iDefault;            }             else            {                int iRet;                if (Int32.TryParse(sRet, out iRet))                {                    return iRet;                }                else                {                    return iDefault;                }            }        }        #endregion GetterHelpers         #region SetterHelpers        /// <summary>        /// Update or create a string preference.        /// </summary>        /// <param name="sPrefName"></param>        /// <param name="sValue"></param>        public void SetStringPref(string sPrefName, string sValue)        {            this[sPrefName] = sValue;        }         /// <summary>        /// Update or create a Int32 Preference        /// </summary>        /// <param name="sPrefName"></param>        /// <param name="iValue"></param>        public void SetInt32Pref(string sPrefName, Int32 iValue)        {            this[sPrefName] = iValue.ToString();        }         /// <summary>        /// Update or create a Boolean preference.        /// </summary>        /// <param name="sPrefName"></param>        /// <param name="bValue"></param>        public void SetBoolPref(string sPrefName, bool bValue)        {            this[sPrefName] = bValue.ToString();        }        #endregion SetterHelpers         /// <summary>        /// Delete a Preference from the collection.        /// </summary>        /// <param name="sPrefName">The name of the Preference.</param>        public void RemovePref(string sPrefName)        {            bool _bNotifyChange = false;            try            {                _RWLockPrefs.AcquireWriterLock(Timeout.Infinite);                _bNotifyChange = _dictPrefs.ContainsKey(sPrefName);                _dictPrefs.Remove(sPrefName);            }            finally            {                _RWLockPrefs.ReleaseWriterLock();            }            if (_bNotifyChange)            {                PrefChangeEventArgs oArgs = new PrefChangeEventArgs(sPrefName, String.Empty);                AsyncNotifyWatchers(oArgs);            }        }         /// <summary>        /// Remove all watchers and write the registry.        /// </summary>        public void Close()        {            _listWatchers.Clear();            WriteRegistry();        }         /// <summary>        /// Return a short description of the contents of the preference bag        /// </summary>        /// <returns>Single-line string</returns>        public override string ToString()        {            return ToString(false);        }         /// <summary>        /// Return a string-based serialization of the Preferences settings.        /// </summary>        /// <param name="bVerbose">TRUE for a multi-line format with all preferences</param>        /// <returns>String</returns>        internal string ToString(bool bVerbose)        {            StringBuilder sbResult = new StringBuilder(128);            try            {                _RWLockPrefs.AcquireReaderLock(Timeout.Infinite);                sbResult.AppendFormat("PreferenceBag [{0} Preferences. {1} Watchers.]", _dictPrefs.Count, _listWatchers.Count);                if (bVerbose)                {                    sbResult.Append("\r\n");                    foreach (DictionaryEntry dePrefVal in _dictPrefs)                    {                        sbResult.AppendFormat("{0}:\t{1}\r\n", dePrefVal.Key, dePrefVal.Value);                    }                }            }            finally            {                _RWLockPrefs.ReleaseReaderLock();            }            return sbResult.ToString();        }         internal string FindMatches(string sFilter)        {            StringBuilder sbResult = new StringBuilder(128);            try            {                _RWLockPrefs.AcquireReaderLock(Timeout.Infinite);                foreach (DictionaryEntry dePrefVal in _dictPrefs)                {                    if (((string)dePrefVal.Key).IndexOf(sFilter, StringComparison.OrdinalIgnoreCase) > -1)                    {                        sbResult.AppendFormat("{0}:\t{1}\r\n", dePrefVal.Key, dePrefVal.Value);                    }                }            }            finally            {                _RWLockPrefs.ReleaseReaderLock();            }            return sbResult.ToString();        }         #region Watchers         /// <summary>        /// A simple struct which contains a Branch identifier and EventHandler        /// </summary>        public struct PrefWatcher        {            internal PrefWatcher(string sPrefixFilter, EventHandler<PrefChangeEventArgs> fnHandler)            {                sPrefixToWatch = sPrefixFilter;                fnToNotify = fnHandler;            }                        internal readonly EventHandler<PrefChangeEventArgs> fnToNotify;            internal readonly string sPrefixToWatch;        }         /// <summary>        /// Add a watcher for changes to the specified preference or preference branch.        /// </summary>        /// <param name="sPrefixFilter">Preference branch to monitor</param>        /// <param name="pcehHandler">The EventHandler accepting PrefChangeEventArgs to notify</param>        public PreferenceBag.PrefWatcher AddWatcher(string sPrefixFilter, EventHandler<PrefChangeEventArgs> pcehHandler)        {            // TODO: Validate sBranchFilter?                        PrefWatcher wliNew = new PrefWatcher(sPrefixFilter.ToLower(), pcehHandler);            _RWLockWatchers.AcquireWriterLock(Timeout.Infinite);            try            {                _listWatchers.Add(wliNew);            }            finally            {                _RWLockWatchers.ReleaseWriterLock();            }            return wliNew;        }         /// <summary>        /// Remove a previously attached Watcher        /// </summary>        /// <param name="wliToRemove">The previously-specified Watcher</param>        public void RemoveWatcher(PreferenceBag.PrefWatcher wliToRemove)        {            _RWLockWatchers.AcquireWriterLock(Timeout.Infinite);            try            {                _listWatchers.Remove(wliToRemove);            }            finally            {                _RWLockWatchers.ReleaseWriterLock();            }        }         /// <summary>        /// This function executes on a single background thread and notifies any registered        /// Watchers of changes in preferences they care about.        /// </summary>        /// <param name="objThreadState">A string containing the name of the Branch that changed</param>        private void _NotifyThreadExecute(object objThreadState)        {            PrefChangeEventArgs oArgs = (PrefChangeEventArgs)objThreadState;            string sBranch = oArgs.PrefName;             List<EventHandler<PrefChangeEventArgs>> listToNotify = null;            try            {                #region BuildListofInterestedWatchers                _RWLockWatchers.AcquireReaderLock(Timeout.Infinite);                try                {                    foreach (PrefWatcher wliEntry in _listWatchers)                    {                        if (sBranch.StartsWith(wliEntry.sPrefixToWatch, StringComparison.Ordinal))                        {                            if (null == listToNotify)                            {                                listToNotify = new List<EventHandler<PrefChangeEventArgs>>();                            }                             listToNotify.Add(wliEntry.fnToNotify);                        }                    }                }                finally                {                    _RWLockWatchers.ReleaseReaderLock();                }                #endregion BuildListofInterestedWatchers                 #region NotifyEachInterestedWatcher                if (null != listToNotify)                {                    foreach (EventHandler<PrefChangeEventArgs> oEach in listToNotify)                    {                        try                        {                            oEach(this, oArgs);                        }                        catch (Exception eX)                        {                            FiddlerApplication.ReportException(eX);                        }                    }                } // else NobodyWatchingThisBranch...                #endregion NotifyEachInterestedWatcher            }            catch (Exception eX)            {                FiddlerApplication.ReportException(eX);            }        }         /// <summary>        /// Spawn a background thread to notify any interested Watchers of changes to the Target preference branch.        /// </summary>        /// <param name="oNotifyArgs">The arguments to pass to the interested Watchers</param>        private void AsyncNotifyWatchers(PrefChangeEventArgs oNotifyArgs)        {            ThreadPool.UnsafeQueueUserWorkItem(_NotifyThreadExecute, oNotifyArgs);        }        #endregion Watchers    }}

I’m hoping that add-ons and scripts will quickly move to the new Preferences System.

-Eric

Fiddler New Features – DNS Failover

EricLaw — Tue, 04 May 2010 03:33:00 GMT

Fiddler 2.2.9 introduces a ton of new features under the hood. The one I’m going to talk about in this quick note is called “DNS Failover.”

When a client attempts to connect to a web server, it must first resolve the hostname of the server (e.g. www.example.com) into an IP address to which a TCP/IP connection will be made (e.g. 192.0.32.10). The Domain Name System (DNS) is typically used to perform this mapping. Now, it’s important to understand that a DNS resolution can return multiple IP addresses, and many clients will attempt to “fail over” between addresses if a TCP/IP connection to the first address returned cannot be made^[1].

Prior to Fiddler 2.2.9, fail over was not supported, which meant that if a connection could not be made to the very first address returned from DNS, Fiddler would report a connection failure. Beyond the rare case where an individual server was temporarily unavailable, there were two other cases where this posed a real problem for Fiddler users.

Cases where an Upstream Gateway Proxy relied upon DNS Failover
The Visual Studio Development Server (Cassini) on Vista+

The problem with the Upstream Gateway Proxy was occasionally hit by Microsoft Employees. We’re all behind a proxy (let’s call it “ITProxy”) at work, and our IT department uses DNS to return more than ten IP addresses for ITProxy, so that if one proxy server is temporarily down, traffic will seemlessly flow to the next proxy in the list. Unfortunately, if the first proxy in the list was unavailable, Fiddler users would find all sites on the Internet unreachable because Fiddler would ignore the upstream proxy setting if the first returned IP address was unreachable. Without an upstream proxy, clients on our corporate network are not able to reach the Internet.

The problem with the Visual Studio Development Server is both more subtle and more interesting. The issue stemmed from the fact that Cassini listens only on the IPv4 interface (e.g. 127.0.0.1). Windows Vista and Windows 7 enable IPv6 by default, and their DNS stacks are configured to return IPv6 addresses first. So, the address list for “Localhost” would return the addresses “[::1], 127.0.0.1” by default. Fiddler would attempt to contact Cassini using the IPv6 interface, find that it wasn’t listening, and immediately give up, refusing to fall back to the IPv4 address which was second in the list. Cassini users typically would work around this problem by using the virtual hostname “ipv4.fiddler” which, as you probably guessed, is treated as “127.0.0.1” by Fiddler. Why not just use 127.0.0.1 directly? Because that address is hardcoded to bypass proxies (like Fiddler) by many web clients, including .NET and WinINET/IE. (That is a topic for a future blog post.)

Fiddler 2.2.9 corrects this limitation by supporting DNS fail over. Fiddler will now attempt to connect to up to three different IP addresses returned from a DNS resolution before giving up and returning an error to the client.

If Fiddler is forced to rely upon DNS fail over when making a connection to a server, a Session Flag is added to the session-- it’s named x-DNS-Failover. If an attempt to connect to a Upstream Gateway Proxy fails during Fiddler's startup, a note will be put in the Fiddler Log tab so that the user may understand why they may not be able to reach Internet sites. If you'd like to disable the DNS fail over feature, you can set the fiddler.network.dns.fallback preference to False.

That’s all for now…

-Eric

^[1]For instance, Internet Explorer will “fail over” up to 5 times per connection attempt; WinINET uses the INTERNET_OPTION_CONNECT_RETRIES option to determine how many attempts to make.

Announcing Fiddler 2.2.9

EricLaw — Sun, 25 Apr 2010 01:00:00 GMT

The Beta version of Fiddler 2.2.9 is now available for download. The update notification's changelist hits the highlights, but there's a ton of new goodies in the new version which I'll be talking about over the next week or so. Beyond a huge crop of architectural and performance improvements, there are tons of bugfixes and some useful new features suggested by the community.

Please download it, try it out, and let me know if you encounter any problems or have any suggestions.

Thanks!

-Eric

PS: Version 2.2.9 of FiddlerCore, the .NET class library, is also now available for .NET Developers. I'll be writing about this more soon too!

Announcing the Fiddler Blog

EricLaw — Sun, 25 Apr 2010 00:52:00 GMT

Welcome to the new Fiddler blog on MSDN! I'm Eric, developer of the Fiddler Web Debugger.

While I occasionally would blog Fiddler news over on BlogSpot, I didn't do so very often, and certainly not in the depth that I provide in my other MSDN blog, IEInternals. So I've started this blog so I'll have a place to talk about:

New versions of Fiddler and FiddlerCore
Fiddler Add-ons and Extensions
Any books / talks / articles that relate to Fiddler
Interesting things being created by the Fiddler community
Miscellaneous .NET things I've learned while writing Fiddler
Web debugging in general
Anything else that comes up :-)

So, thanks for reading... I hope you'll find this blog a valuable source of information. If you have any suggestions for what you'd like to hear more about, please let me know!

-Eric Lawrence