I am working on HTTP client code that makes REST api calls to a server and processes responses.

The client talks to server via SSL, but the SSL session is terminated at a Web Application Firewall.The Web Application Firewall is like a man-in-the-middle proxy.

I would like to make the client robust enough to handle any erroneous behavior by this proxy. Are there any tools that provide such tests? For instance, the proxy could redirect the client elsewhere, or modify the response sent by the server. I am able to find a lot of test suites to test web server code, but not client code. I looked at https://mitmproxy.org/ and some options in Kali Linux that let you setup malicious web server that serves malware. Are there any other options?

1 Answer 1


Your client should check response for errors regardless error source: be it proxy error, server error or TCP error.

Your should simulate web server (the way you do it depends on your favorite language and environment) and check following situations:

  • 404, 403, 500 and other non-200 error codes. You can check status codes like "moved permanently" as well.
  • Junk response (not even valid HTTP, i.e. stream of random bytes)
  • Valid HTTP with junk inside (if you wait for json, then send .png as response body)
  • Interrupted response (send valid respond but disconnect client after sending 95% of it)
  • Timeout (accept request and make client wait for 40 seconds before answer)
  • Huge bomb (send 500 mb as response)
  • Response with logic errors (i.e. if you wait for positive integer "age" field in JSON, try sending "-9000" or "abc123" or random 500 bytes for it)

If all these cases are handled correctly, your client is ready for any proxy error, I believe.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .